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Preface 

National  Defense  University's  Directorate  of  Advanced  Concepts,  Technologies  and 
Information  Strategies  (ACTIS)  and  School  of  Information  Warfare  and  Strategy  (SIWS) 
are  pleased  to  inaugurate  a  new  series  of  publications  by  the  National  Defense  University 
Press  intended  to  explore  the  evolving  relationship  between  the  law  and  information 
warfare.  The  emerging  debate  over  information  warfare  and  the  information  component 
of  national  power  has  frequently  emphasized  technological  issues  with  scant  regard  for 
the  legal  environment  in  which  the  Information  Age  is  occurring,  yet  this  may  obscure 
some  very  real  and  unsettling  legal  issues  that  will  have  to  be  solved  in  order  to  wage 
information  warfare.  One  of  the  persistent  trends  in  the  related  histories  of  the  law  and 
warfare  is  that  whenever  war,  or  civil  society  in  general,  has  extended  into  a  new 
environment,  such  as  underwater  or  the  aerospace,  the  law  has  had  to  "play  catch-up"  to 
the  technology.  This  should  be  no  surprise:  after  all,  no  one  writes  law  for  something  that 
does  not  exist,  such  as  aerial  warfare  before  the  invention  of  the  airplane.  The  same  is 
true  for  cyberspace,  which  is  why  many  argue  that  the  legal  environment  for  information 
warfare  is  even  less  well  framed  than  the  technology  making  it  possible.  To  the  theater 
campaign  or  operations  planner  who  must  wrestle  with  "here  and  now"  issues  regarding 
the  use  of  information  warfare  and  protection  from  the  enemy's  potential  use  of  it, 
theoretical  discussions  of  information  warfare  and  the  law  are  a  thin  gruel  when  weighed 
against  the  need  for  firm  guidelines,  rules  of  engagement,  and  policy. 

When  one  begins  to  examine  the  relationship  between  information  warfare  and  the  law, 
especially  international  law  and  the  law  of  war,  it  immediately  becomes  apparent  that 
some  fundamental  questions  need  to  be  explored.  What,  for  example,  is  war  in  the 
Information  Age,  and  what  types  of  activities  between  information  actors,  whether  nation 
states  or  non-state  entities,  will  we  call  information  warfare?  What  is  an  "act  of 
(information)  warfare,"  to  use  that  imprecise  but  expressive  and  widely  used  term?  What 
is  "war"  in  the  Information  Age?  Who  is  a  "combatant"?  What  are  "force,"  "armed 
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attack,"  or  "armed  aggression"  (terms  from  the  UN  Charter)  in  the  Information  Age,  and 
do  they  automatieally  equate  to  IW?  Does  "war"  between  states  require  physieal  violenee, 
kinetie  energy,  and  human  easualties?  What  role  is  played  by  intent?  How  might  the  law 
itself  ehange  in  response  to  the  Information  Age?  How  will  long-established  legal 
prineiples  sueh  as  national  sovereignty  and  the  inviolability  of  national  boundaries  be 
affeeted  by  the  ability  of  cyberspaee  to  transeend  sueh  eoneepts?  Will  the  teehnologies  of 
the  Information  Age,  by  bringing  atroeities  and  violations  of  the  law  of  war  into  the 
intense  and  immediate  glare  of  global  publie  awareness,  inerease  the  observance  of  the 
legal  norms  of  armed  eonflict?  Information  warfare  also  raises  specific  legal  issues 
related  to  eomputer  erime:  what  is  a  erime,  who  eommits  it,  and  what  does  the  law  say 
about  it?  These  questions  and  issues  merely  hint  at  the  tremendous  uneertainties  that 
surround  the  evolving  discipline  of  information  warfare  and  field  of  national  and  global 
information  power. 

This  series  of  publieations  is  intended  to  provide  a  eontext  within  whieh  to  examine  IW 
in  a  legal  sense  and  explore  speeifie  issues  such  as  the  laws  of  war  or  standing 
international  agreements  to  whieh  the  United  States  is  a  signatory,  sueh  as  the 
International  Teleeommunieations  Union  or  the  UN  Charter.  This  initial  monograph,  by 
Lawrenee  T.  Greenberg,  Seymour  E.  Goodman,  and  Kevin  J.  Soo  Hoo,  is  an  outstanding 
kickoff  to  this  series.  The  authors,  members  of  the  Project  on  Information  Technology 
and  International  Seeurity  at  Stanford  University's  Center  for  International  Seeurity  and 
Arms  Control,  have  surfaeed  and  explored  some  profound  issues  that  will  shape  the  legal 
eontext  within  whieh  information  warfare  may  be  waged  and  national  information  power 
exerted  in  the  eoming  years.  They  note  that  despite  the  newness  of  both  the  teehnology  of 
IW  and  the  evolving  eoneepts  for  its  employment,  legal  eonstraints  will  almost  eertainly 
apply  to  IW.  Also  noting  that  eoneepts  of  sovereignty  based  on  physieal  territoriality  do 
not  funetion  well  in  eyberspaee,  the  authors  observe  that  there  is  no  authoritative  legal  or 
international  agreement  as  to  whether  an  IW  "attaek"  equals  an  "attaek"  or  "use  of  foree" 
in  the  traditional  sense.  With  this  as  a  eontext,  the  authors  offer  several  legal  approaches 
the  United  States  eould  employ  to  proteet  the  national  information  infrastrueture  or 
elarify  options  useful  for  offense,  defense,  or  retaliation.  They  are  under  no  illusions  that 
they  have  answered  all  of  the  questions  relating  to  information  warfare  and  international 
law,  but  rather  ean  take  great  satisfaetion  in  having  eogently  and  thoroughly  explored  key 
legal  questions  and  issues  that  information  warriors,  jurists,  and  policy  makers  will 
wrestle  with  in  the  future.  In  doing  so  they  have  made  a  signifieant  and  lasting 
eontribution  to  national  and  international  security,  stability,  and  peace. 

Daniel  T.  Kuehl,  Ph.D 

Professor,  Sehool  of  Information  Warfare  &  Strategy 
Series  General  Editor 


Executive  Summary 


The  development  of  "information  warfare"  presents  international  legal  issues  that  will 
eomplicate  nations'  efforts  both  to  exeeute  and  to  respond  to  eertain  information  warfare 
attaeks,  speeifieally  those  using  eomputers,  teleeommunications,  or  networks  to  attaek 
adversary  information  systems.  Some  legal  eonstraints  will  eertainly  apply  to  information 
warfare,  either  beeause  the  constraints  explicitly  regulate  particular  actions,  or  because 
more  general  principles  of  international  law  govern  the  effects  of  those  actions. 
Nevertheless,  the  novelty  of  certain  information  warfare  techniques  may  remove  them 
from  application  of  established  legal  categories.  Furthermore,  the  ability  of  signals  to 
travel  across  international  networks  and  affect  systems  in  distant  countries  conflicts  with 
the  longstanding  principle  of  national,  territorial  sovereignty. 

First,  it  has  not  been  established  that  information  attacks,  particularly  when  they  are  not 
directly  lethal  or  physically  destructive,  constitute  the  use  of  "force"  or  "armed  attack" 
under  such  provisions  as  the  United  Nations  Charter.  Such  attacks  thus  may  be  legal 
forms  of  coercion  even  in  peacetime,  and  the  use  of  conventional  armed  force  may  not  be 
an  appropriate  response  to  such  attacks;  indeed,  such  a  response  might  be  considered  an 
act  of  aggression.  No  provision  of  international  law  prevents  countries  from  taking  many 
actions  against  other  states,  such  as  embargoes,  that  inflict  great  hardship  on  those  states 
and  their  populations.  Second,  it  is  equally  unclear  whether  some  of  the  damage  that 
information  warfare  attacks  could  inflict,  as  by  disrupting  government  or  private 
databases  and  systems,  is  the  sort  of  damage  that  international  humanitarian  law  is 
intended  to  restrain.  Finally,  where  attacks  can  be  executed  across  international  networks, 
the  United  States  (among  others)  may  need  to  rely  upon  foreign  assistance  in  identifying 
and  responding  to  those  who  have  attacked  it. 

The  ambiguous  state  of  international  law  regarding  information  warfare  may  leave  space 
for  the  United  States  to  pursue  information  warfare  activities.  Conversely,  it  may  permit 
adversaries  to  attack  the  United  States  and  its  systems.  When  considering  policy  options, 
U.S.  decision  makers  must  balance  those  offensive  opportunities  against  defensive 
vulnerabilities,  a  balance  that  is  beyond  the  scope  of  this  report.  Nevertheless,  we  can 
discuss  several,  nonexclusive  international  legal  approaches  that  the  United  States  may 
pursue  to  protect  its  systems  or  clarify  its  offensive,  defensive,  and  retaliatory  options. 

First,  the  United  States  could  pursue  international  definitions  of  such  concepts  as  "force" 
or  "armed  attack"  as  they  apply  to  information  warfare;  such  definitions  could  help 
establish  when  such  attacks  can  be  conducted  and  how  countries  may  respond  to  them. 
Second,  the  United  States  could  pursue  international  cooperation  against  information 
warfare  attacks,  encouraging  cooperation  in  the  investigation  and  prosecution  of  those 
responsible  for  the  attacks,  particularly  terrorists  and  other  criminals.  Third,  the  United 
States  may  pursue  agreements  to  protect  critical  information  systems,  either  by  putting 
them  off  limits  for  legitimate  attacks,  or  creating  international  protection  regimes  for 
particular  systems.  Fourth,  some  have  suggested  that  information  warfare  may  be  an 
appropriate  area  for  arms  control  agreements.  However,  several  factors,  including  the 
novelty  of  many  information  warfare  technologies  and  techniques,  the  wide 
dissemination,  small  size,  and  predominantly  civilian  nature  of  much  information 


technology,  and  the  danger  that  arms  control  would  not  apply  to  non-state  actors,  such  as 
terrorists,  all  suggest  that  the  pursuit  of  arms  control  would  be  premature  at  best, 
especially  in  connection  to  largely  nonlethal  technologies  in  which  the  United  States 
apparently  leads  other  nations.  Despite  the  apparent  attractiveness  of  taking  legal 
measures  to  either  protect  U.S.  systems  or  preserve  the  availability  of  information 
weapons  for  U.S.  use,  law  may  not  be  nimble  enough  to  keep  up  with  technological 
change,  and  thus  will  not  be  a  substitute  for  vigilance,  preparedness,  and  ingenuity. 


Chapter  1 :  Introduction 


The  Development  of  Information  Warfare 

As  the  worldwide  explosion  of  information  technology,  including  computing, 
telecommunications,  and  networks,  is  changing  the  way  we  conduct  business, 
government,  and  education,  it  promises  to  change  the  way  we  fight/  Information 
technology  is  diffusing  into  virtually  all  military  weapons,  communications,  and 
command  and  control  systems,  as  well  as  the  civilian  systems  that  support  modern 
industrial  (or  post-industrial)  economies  and  their  military  efforts.  Some  of  the  new  ways 
of  fighting  have  been  labeled  "information  warfare,"  which  has  been  broadly  defined  as 
"any  action  to  deny,  exploit,  corrupt,  or  destroy  the  enemy's  information  and  its 
functions;  protecting  ourselves  against  those  actions;  and  exploiting  our  own  military 
information  functions."  As  such,  information  warfare  includes  both  new  techniques, 
such  as  computer  intrusion  and  disruption  and  telecommunications  spoofing,  and  old 
ones,  such  as  ruses,  camouflage,  and  physical  attacks  on  observation  posts  and  lines  of 
communication.  Some  have  suggested  that  information  warfare  could  usher  in  an  era  of 
largely  bloodless  conflict;  battle  would  occur  in  "cyberspace,"  as  U.S.  "information 
warriors"  would  be  able  to  disable  important  enemy  command  and  control  or  civilian 
infrastructure  systems  with  little,  if  any,  loss  of  life.^  Others  have  projected  futures  of 
conflict  in  which  the  bloodletting  is  only  enhanced  by  improved  and  broadened 
communications."^  Still  others  have  suggested  that  information  technology  may  contribute 
to  the  development  of  new  forms  of  social  organization,  along  with  new  forms  of 
conflict.^ 

Whatever  the  development  and  diffusion  of  information  technology  mean  for  the  future 
of  warfare,  it  is  apparent  that  some  of  the  new  forms  of  attack  that  information 
technology  enables  may  be  qualitatively  different  from  prior  forms  of  attack.  The  use  of 
such  tools  as  computer  intrusion  and  computer  viruses,  for  example,  may  take  war  out  of 
the  physical,  kinetic  world  and  bring  it  into  an  intangible,  electronic  one.  These  newer 
forms  of  attacks,  some  of  which  may  seem  to  be  the  products  of  science  fiction,  range 
along  continuums  extending  from  those  with  no  physical  impact  on  the  enemy  to  some 
that  would  cause  grave  destruction  or  loss  of  life,  from  those  with  no  physical  intrusion 
beyond  national  borders  to  those  requiring  traditional,  military  invasions,  and  from  those 
affecting  purely  civilian  targets  to  those  hitting  purely  military  ones.  Attacks  could  be 
conducted  from  a  distance,  through  radio  waves  or  international  communications 
networks,  with  no  physical  intrusion  beyond  enemy  borders.  Damage  could  range  from 
military  or  civilian  deaths  from  system  malfunctions,  to  the  denial  of  service  of  important 
military  or  governmental  systems  in  time  of  crisis,  to  widespread  fear,  economic 
hardship,  or  merely  inconvenience  for  civilian  populations  who  depend  upon  information 
systems  in  their  daily  lives. 

The  following  are  examples-some  likely,  some  perhaps  farfetched-of  attacks  that 
countries  or  nongovernmental  entities  might  pursue,  or  suffer,  as  they  wage  warfare  in 
the  Information  Age. 
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•  A  "trap  door"  might  be  hidden  in  the  eode  controlling  switching  centers  of  the 
Public  Switched  Network,  causing  portions  of  it  to  fail  on  command.^ 

•  A  mass  dialing  attack  by  personal  computers  might  overwhelm  a  local  phone 
system.’ 

•  A  "logic  bomb"  or  other  intrusion  into  rail  computer  systems  might  cause  trains  to 
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be  misrouted  and,  perhaps,  crash. 

•  An  enemy's  radio  and  television  network  might  be  taken  over  electronically,  and 
then  used  to  broadcast  propaganda  or  other  information.^  Advanced  techniques 
such  as  "video  morphing"  could  make  the  new  broadcasts  indistinguishable  from 
the  enemy's  own  usual  broadcasts.^'* 

•  A  computer  intruder  might  remotely  alter  the  formulas  of  medication  at 
pharmaceutical  manufacturers,  or  personal  medical  information,  such  as  blood 
type,  in  medical  databases.** 

12 

•  A  concerted  e-mail  attack  might  overwhelm  or  paralyze  a  significant  network. 

•  Computer  intruders  might  divert  funds  from  bank  computers,  or  corrupt  data  in 
bank  databases,  causing  disruption  or  panic  as  banks  need  to  shut  down  to  address 
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their  problems. 

•  Computer  intruders  might  steal  and  disclose  confidential  personal,  medical,  or 
financial  information,  as  a  tool  of  blackmail,  extortion,  or  to  cause  widespread 
social  disruption  or  embarrassment. 

•  A  "computer  worm"  or  "virus"  could  travel  from  computer  to  computer  across  a 
network,  damaging  data  and  disrupting  systems.*"* 

•  An  "infoblockade"  could  permit  little  or  no  electronic  information  to  enter  or 
leave  a  nation's  borders.*^ 

•  A  nation's  command  and  control  infrastructure  could  be  disrupted,  with  individual 
military  units  unable  to  communicate  with  each  other,  or  with  a  central  command. 

•  Stock  or  commodity  exchanges,  electric  power  grids  and  municipal  traffic  control 
systems,  and,  as  is  frequently  suggested,  air  traffic  control  or  navigation  systems 
could  be  manipulated  or  disrupted,  with  accompanying  economic  or  societal 
disruption,  physical  destruction,  or  loss  of  life.  *^ 

International  Law 
The  Law  of  Nations 

Law  attempts  to  govern  war,  as  it  does  most  human  endeavors.  International  law  governs 
interaction  among  nations.  International  law  primarily  consists  of  "conventional"  law  and 


2 


"customary"  law.'^  Conventional  law  is  that  made  by  treaty  or  other  explieit  agreement 
among  nations,  who  are  bound  to  their  agreements  under  the  principle  of  pacta  sunt 
servanda,  or  "agreements  are  to  be  observed."  Examples  of  conventional  law  would 
include  the  Paris  Peaee  Treaty  of  1783,  which  ended  the  U.S.  War  of  Independence  and 
fixed  the  borders  of  the  new  republic,  the  1968  Treaty  on  the  Non-Proliferation  of 
Nuclear  Weapons,  and  the  General  Agreement  on  Tariffs  and  Trade  (GATT). 

Customary  law  results  from  the  general  and  consistent  praetice  of  states'  opinio  juris,  or 
with  the  understanding  that  the  practice  is  required  by  law,  not  just  expedienee. 
Customary  law  may  develop  from  understandings  reflected  in  treaties  or  other 
agreements,  even  if  they  have  not  been  ratified,  deelarations  or  votes  of  international 
bodies  such  as  the  General  Assembly  of  the  United  Nations,  or  the  statements  and  aetions 
of  governments  and  their  officials. There  is  no  universally  accepted  way  to  determine 
whether  a  customary  international  legal  norm  has  been  established.  To  a  great  extent, 
customary  international  law  must  be  like  obscenity  to  the  late  U.S.  Supreme  Court  Justice 
Potter  Stewart-something  we  know  when  we  see  it.  Examples  of  eustomary  law  include 
the  traditional  proteeted  status  of  diplomats  and  the  historical  three-nautical  mile  claim  to 
coastal  territorial  waters. 

Even  when  legal  norms  seem  well-established  in  theory,  patterns  of  eontrary  state 
praetice  may  eontribute  to  the  decline  or  alteration  of  the  principles.  Just  as  popular 
disregard  for  a  trademark,  such  as  cellophane,  aspirin,  or  thermos,  ean  result  in  that 
trademark  losing  its  legal  force  and  becoming  a  generic  term,  violation  of  an  ostensible 

customary  legal  prineiple  ean  eause  its  demise.  Eaw  based  upon  actors'  recognition  that 
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it  is  indeed  law  loses  force  when  those  actors  no  longer  reeognize  it. 

In  eonsidering  international  law,  particularly  in  the  context  of  national  seeurity,  it  is 
important  to  stress  some  distinctions  between  international  and  domestic  law.  Unlike 
most  nations'  domestic  law,  international  law  is  not  a  body  of  law  ereated  by  legislatures 
and  courts  and  enforced  by  police  through  a  court  system.  Rather,  international  law  is 
generally  established  by  agreement,  either  explieit  or  taeit,  among  the  parties  who  will  be 
bound  by  it,  mueh  as  private  parties  enter  into  contracts  with  each  other.  Although 
international  legal  forums,  such  as  the  International  Court  of  Justiee,  do  exist,  their 
enforcement  meehanisms  are  limited  at  best;  no  international  police  force  walks  the 
world  beat.  Consequently,  a  country  that  is  willing  to  accept  the  political  and  diplomatic 
consequences  that  may  ensue  when  it  defies  international  law  may  do  so.  As  a  crude 
example,  the  Revolutionary  Islamic  government  of  Iran  blatantly  disregarded  the 
traditional  sovereignty  and  sanetuary  of  the  U.S.  Embassy  in  Tehran  in  the  late  1970s  and 
early  1980s,  but  if  it  had  any  concerns  about  external  reactions,  those  concerns  seemed 
more  direeted  at  the  threat  of  eeonomie  sanctions  or  U.S.  military  action,  not  at  some 
global  poliee  force.  It  seems  likely  that  nations  will  be  least  likely  to  follow  the  dietates 
of  international  law  where  those  dictates  endanger  or  eonfiict  with  the  pursuit  of  their 
fundamental  interests,  including  national  security. 

The  Legal  Challenges  of  Information  Warfare 

Erom  a  legal  perspective,  the  older  forms  of  information  warfare  pose  few  unanswered 
questions  under  eustomary  or  treaty  law.  Eor  example,  the  use  of  camouflage  to  elude 
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enemy  observers  was  old  even  when  Maeduff  and  his  men  brought  Burnham  Wood  to 
Dunsinane;^^  aneient  Greek  soldiers  blinded  their  foes  by  refleeting  the  sun  off  their 
shields;  and  both  sides  attempted  to  cut  each  others'  telegraph  lines  during  the  U.S.  Civil 
War,  and  there  is  little  doubt  of  these  actions'  propriety.  Similarly,  wartime  physical 
attacks  against  military  observation  systems,  from  lookout  posts  to  radar  stations,  are 
unquestionably  acceptable  under  international  law. 

But  the  development  of  information  technology,  specifically  computers, 
telecommunications,  and  networks,  makes  it  possible  for  adversaries  to  attack  each  other 
in  new  ways  and  with  new  forms  of  damage,  and  may  create  new  targets  for  attack. 
Attackers  may  use  international  networks  to  damage  or  disrupt  enemy  systems,  without 
ever  physically  entering  the  enemy's  country,  and  countries'  dependence  upon  electronic 
or  other  information-based  systems  may  make  those  systems  particularly  attractive 
targets.  Furthermore,  the  dual-use  nature  of  many  information  systems  and  infrastructures 
may  blur  the  distinction  between  military  and  civilian  targets. 

Such  new  attacks  may  pose  problems  for  international  law  because  law  is  inherently 
conservative;  technological  change  may  enable  new  activities  that  do  not  fit  within 
existing  legal  categories,  or  may  reveal  contradictions  among  existing  legal  principles. 
Information  warfare  challenges  existing  international  law  in  three  primary  ways.  First, 
the  sort  of  intangible  damage  that  such  attacks  may  cause  may  be  analytically  different 
from  the  physical  damage  caused  by  traditional  warfare.  The  kind  of  destruction  that 
bombs  and  bullets  cause  is  easy  to  see  and  understand,  and  fits  well  within  longstanding 
views  of  what  war  means.  In  contrast,  the  disruption  of  information  systems,  including 
the  corruption  or  manipulation  of  stored  or  transmitted  data,  may  cause  intangible 
damage,  such  as  disruption  of  civil  society  or  government  services  that  may  be  more 
closely  equivalent  to  activities  such  as  economic  sanctions  that  may  be  undertaken  in 
times  of  peace. 

Second,  the  ability  of  signals  to  travel  across  international  networks  or  through  the 
atmosphere  as  radio  waves  challenges  the  concept  of  national,  territorial  sovereignty. 
Sovereignty,  which  has  been  a  fundamental  principle  of  international  law  since  the  Treaty 
of  Westphalia  of  1648,  holds  that  each  nation  has  exclusive  authority  over  events  within 
its  borders.^"^  Sovereignty  may  not  be  suited  to  an  increasingly  networked,  or  "wired" 
world,  as  signals  traveling  across  networks  or  as  electromagnetic  waves  may  cross 
international  borders  quickly  and  with  impunity,  allowing  individuals  or  groups  to  affect 
systems  across  the  globe,  while  national  legal  authority  generally  stops  at  those  same 
borders.  Furthermore,  the  intangible  violation  of  borders  that  signals  may  cause  may  not 
be  the  sort  of  violation  traditionally  understood  to  be  part  of  a  military  attack. 

Third,  just  as  information  warfare  attacks  may  be  difficult  to  define  as  "peace"  or  "war," 
it  may  be  hard  to  define  their  targets  as  military  (and  thus  generally  legitimate  targets)  or 
civilian  (generally  forbidden).  Furthermore,  the  intangible  damage  the  attacks  cause  may 
not  be  the  sort  of  injuries  against  which  the  humanitarian  law  of  war  is  designed  to 
protect  noncombatants. 
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Graphic  representations  may  be  helpful  in  understanding  the  analytieal  eontinuums  along 
whieh  information  attaeks  may  oeeur.  Figure  1  illustrates  the  physieal  destruetiveness  of 
attaeks,  ranging  from  a  propaganda  broadeast,  whieh  may  have  no  physieal  effeets  on  its 
target,  to  a  eomputer  intrusion  that  may  hinder  the  workings  of  government,  military  or 
eivilian  systems,  to  a  eomputer  intrusion  that  eauses  a  destruetive  or  fatal  system  failure. 
Most  physieally  destruetive,  of  eourse,  would  be  an  attaek  using  massive  kinetie  foree, 
with  a  thermonuelear  attaek  as  an  extreme  example.  It  is  not  diffieult  to  plaee  attaeks 
along  the  eontinuum  in  a  manner  that  is  not  quite  arbitrary,  although  the  appropriateness 
of  each  particular  point  may  be  debatable.  It  may  be  mueh  harder  to  establish  the  loeation 
of  the  point  on  the  eontinuum  that  divides  "peaee"  from  "war,"  or  to  determine  when  eaeh 
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partieular  attaek  may  be  permissible  under  international  law. 

FIGURE  1 
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Figure  2  illustrates  the  extent  to  whieh  particular  attacks  intrude  aeross  nations'  borders. 
Least  intrusive  would  be  an  "infobloekade,"  whereby  a  eountry's  eommunieations  beyond 
its  borders  would  be  eut  off.  A  eomputer  intrusion  might  be  eonsidered  to  violate  the 
target  eountry's  borders,  whatever  its  destruetive  impact,  although  such  characterization 
may  not  be  inevitable,  as  discussed  in  Part  II.  Espionage,  with  the  infiltration  of  an  agent 
into  the  target  eountry,  would  obviously  require  the  erossing  of  borders,  although  perhaps 
on  a  limited  seale.  Finally,  a  military  invasion's  intrusiveness  is  obvious.  Just  as  the 
destruetiveness  of  an  attaek  may  be  relevant  for  its  eharaeterization  as  "peaee"  or  "war," 
so  too  will  be  this  element  of  intrusion  aeross  borders,  with  the  potential  differenee  that  it 
may  be  easier  to  eharaeterize  the  destruetiveness  of  an  attaek  than  it  may  be  to  determine 
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the  extent  to  whieh  an  attaek  violates  a  nation's  borders  (and  sovereignty). 

FIGURE  2 
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Figure  3  illustrates  the  diverse  eharaeter  of  the  targets  of  potential  attaeks.  Some  targets, 
sueh  as  armored  forees  on  the  battlefield,  are  unambiguously  military  in  eharaeter,  and 
are  thus  the  legitimate  targets  for  attaeks.  Other  targets,  sueh  as  ehurehes,  kindergartens, 
or  hospitals,  are  purely  eivilian  in  eharaeter,  and  may  not  be  made  the  targets  for  attaeks, 
although  they  may  often  suffer  eollateral  damage  from  otherwise  legitimate  attaeks.  The 
aeeeptability  of  other  targets,  ranging  from  government  soeial  serviee  systems  to 
munitions  faetories,  may  vary  with  their  eontribution  to  a  nation's  war  effort.  As 
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discussed,  the  dual-use  nature  of  many  teleeommunieations  and  eomputing  systems  may 
make  them  subjeet  to  attaeks  that  will  have  grave  eivilian  eonsequenees.  The  borderline 
between  legitimate  and  illegitimate  targets  of  war  is  thus  diffieult  to  draw  in  the  abstraet. 
Furthermore,  information  warfare  teehniques  that  may  eause  grave  hardship  to  civilians 
may  not  be  eonsidered  to  be  "war,"  and  may  not  be  eovered  by  the  humanitarian 
provisions  that  attempt  to  lessen  war's  eruelty.^^ 

FIGURE  3 
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The  Purpose  of  This  Book 

The  Importance  of  International  Law  for  U,S,  Policy 

The  United  States  has  a  partieularly  signifieant  stake  in  understanding  how  international 
law  will  apply  to  these  new  forms  of  eonfliot.  First,  as  a  matter  of  domestie  polities,  the 
United  States  has  a  largely  legal  culture.  The  U.S.  Government  is  deseribed  as  one  of 
laws;  in  public  political  rhetoric  acts  are  routinely  described  and  discussed  in  legal  terms, 
and  eharaeterizing  an  aet  as  illegal  ean  be  a  harsh  and  politieally  damaging  eritieism. 
Seeond,  as  a  matter  of  domestie  law,  international  law  is  as  mueh  a  part  of  the  "law  of  the 
land"  as  are  the  statutes  that  Congress  enaets.  Third,  given  the  U.S.  Government's 
apparent  preferenee  in  the  post-Cold  War  era  (and  even  before)  for  aeting  militarily  under 
the  auspiees  of  international  coalitions  or  the  United  Nations,  its  prospeets  for  obtaining 
sueh  auspiees  are  greater  when  it  ean  persuade  other  nations  that  its  aetions  are  legal  and 
those  of  its  foes  are  not.  Finally,  as  the  preeminent  world  power,  and  one  particularly 
dependent  upon  information  systems,  the  United  States  has  a  stake  in  the  international 
status  quo.  To  the  extent  international  law  helps  to  provide  stability  and  proteet  eritieal 
information  systems,  it  may  benefit  U.S.  interests. 

The  Scope  of  This  Book 

This  book  will  identify  issues  that  arise  from  the  development  of  information  warfare 
under  international  law,  and  diseuss  how  the  law  might  be  applied.  It  will  look  at  both 
offensive  information  warfare  and  the  responses  that  a  nation  may  make  to  attaeks  on  its 
information  systems.  Finally,  the  book  will  outline  approaehes  to  resolving  legal 
ambiguities  surrounding  information  warfare  and  addressing  some  of  the  diffieulties  that 
arise  when  old  laws  and  new  teehnologies  eollide. 
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Chapter  2:  The  Conduct  of  Information  Warfare 
and  International  Law 

The  Legality  of  Information  Warfare 

Perhaps  because  of  the  newness  of  much  of  the  technology  involved,  no  provision  of 
international  law  explicitly  prohibits  what  we  now  know  as  information  warfare.  This 
absence  of  prohibitions  is  significant  because,  as  a  crudely  general  rule,  that  which 
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international  law  does  not  prohibit  it  permits.  But  the  absence  is  not  dispositive, 
because  even  where  international  law  does  not  purport  to  address  particular  weapons  or 
technologies,  its  general  principles  may  apply  to  the  use  of  those  weapons  and 
technologies.  Nevertheless,  existing  international  law  leaves  space  for  many  types  of 
information  warfare  techniques  in  many  circumstances. 

International  Telecommunications  Law 

Any  attack  involving  networks  and  telecommunications  may  implicate  the  International 
Telecommunication  Union  (ITU)  and  its  underlying  charter,  the  International 
Telecommunication  Convention  (ITC),  which  apply  to  international  wire  and  radio 
frequency  communications.^^  In  practice,  the  ITU  may  not  substantially  limit  information 
warfare  activities,  particularly  by  the  United  States  and  especially  in  a  wartime  context. 

The  primary  concerns  of  the  ITU  are  interoperability  and  interference.^"^  Its  predecessor 
organization,  the  International  Telegraph  Union,  was  established  in  1865  to  facilitate 
international  telegraph  traffic,  mainly  within  Europe.  One  of  the  Union's  early  sets  of 
regulations  for  radio  required  interoperability  of  maritime  radio  systems,  after  several 
dangerous  naval  incidents  occurred  because  the  Marconi  Wireless  Company,  which  held 
the  exclusive  right  to  install  and  operate  shipboard  radio  equipment,  refused  to  permit  its 
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operators  to  communicate  with  any  station  that  did  not  use  Marconi  equipment. 

The  ITU  and  the  regulations  promulgated  under  it  do  have  some  applicability  to 
information  warfare  attacks  that  use  the  electromagnetic  spectrum  or  international 
telecommunication  networks.  First,  broadcasting  stations  from  one  nation  may  not 
interfere  with  broadcasts  of  other  states'  services  on  their  authorized  frequencies.  The 
International  Frequency  Regulation  Board  (IFRB)  of  the  ITU  allocates  the 
electromagnetic  spectrum  to  prevent  interference.^*  Even  military  installations  must 
observe  the  noninterference  requirement.  Additionally,  offshore  radio  stations  are 
banned,  and  states  may  not  carry  out  the  transmission  of  false  or  misleading  signals. 
Finally,  governments  must  protect  the  secrecy  of  international  correspondence,"^^ 
although  they  retain  the  right  to  stop  radio  or  wire  transmissions  for  national  or  domestic 
security  purposes."^* 

The  aforementioned  provisions  would  seem  to  block  the  disruption  or  spoofing  of 
adversaries'  telecommunications,  but  in  practice  they  may  not.  First,  the  rules  against 
interference  do  not  apply  between  belligerents,  so  wartime  communications  are  fair 
game."^"^  Secondly,  even  in  peacetime,  violation  of  the  ITU  rules  and  regulations  may  have 
limited  repercussions,  especially  for  a  country  as  significant  in  international 
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telecommunications  as  the  United  States.  The  IFRB  is  more  of  a  coordinating  body  than  a 
regulatory  agency and  it  has  no  actual  authority  to  enforce  its  decisions;  rather, 
countries  respect  its  edicts  against  interference  so  that  their  own  communications  will  be 
similarly  protected."^^  Even  if  international  sanctions  appeared  likely,  the  United  States 
might  decide  that  the  risks  it  faced  from  external  interference  would  not  outweigh  its 
need  to  conduct  operations  against  a  particular  adversary.  Finally,  it  is  important  to  note 
that  even  where  information  warfare  activities  do  violate  the  ITU  or  its  regulations,  mere 
violations  are  more  likely  to  be  considered  breaches  of  contractual  obligations  under 
treaty  than  acts  of  war  justifying  forceful  responses."^^ 

Interestingly,  the  Charter  of  the  United  Nations,  drafted  50  years  ago,  appears  to 
contemplate  such  interference  with  a  country's  communications  as  "infoblockades." 
Article  41  provides  that  in  its  effort  to  address  breaches  of  the  peace,  the  UN  Security 
Council  may  call  upon  UN  members  to  disrupt  an  aggressor's  "rail,  sea,  air,  postal, 
telegraphic,  radio,  and  other  means  of  communication." 

Space 

Because  of  the  importance  of  satellites  for  international  telecommunications,  as  well  as 
for  military  (especially  U.S.)  command,  control,  communications,  and  intelligence,  many 
information  warfare  attacks  (including  jamming  or  spooling  of  communications  or  efforts 
to  overcome  them)  may  involve  orbital  assets,  and  thus  implicate  space  law.  Space  law, 
though,  leaves  ample  room  for  information  warfare. 

The  fundamental  document  of  space  law,  the  multilateral  1967  Treaty  on  Principles 
Governing  the  Activities  of  States  in  the  Exploration  and  Use  of  Outer  Space,  Including 
the  Moon  and  Other  Celestial  Bodies  (the  "Outer  Space  Treaty"),  provides  that  all  states 
shall  be  free  to  explore  and  use  outer  space  on  a  basis  of  equality  and  that  no  state  may 
place  into  Earth  orbit  any  objects  carrying  nuclear  weapons  or  any  other  kind  of  "weapon 
of  mass  destruction.""^^  The  1979  Agreement  Concerning  the  Activities  of  States  on  the 
Moon  and  Other  Celestial  Bodies  (the  "Moon  Treaty")  applies  similar  prohibitions  to  the 
moon,"^^  and  also  states  that  the  moon  shall  only  be  used  for  peaceful  purposes. The 
1971  Agreement  Relating  to  the  International  Telecommunications  Satellite  Organization 
(INTEESAT)^'  and  the  1976  Convention  on  the  International  Maritime  Satellite 
Organization  (INMARSAT)  also  affect  telecommunications  and  the  use  of  space,  but 
their  relevance  is  limited  to  principles  of  nondiscrimination  among  nations  using  the 
relevant  satellites. 

None  of  these  conventions  bars  information  warfare  activities  that  make  use  of  satellite 
assets.  First,  although  some  might  argue  that  state  practice  and  such  agreements  as  the 
Moon  Treaty  have  created  a  legal  norm  of  peaceful  use  of  outer  space  or  the  avoidance  of 
orbital  arms  races,^"^  it  is  unquestionable  that  space  can  be,  and  has  been,  used  for  military 
purposes.  Orbital  surveillance  is  legal  and  common,^^  and  space  is  routinely  used  for 
military  communications,  navigation,  and  weapons  guidance.  In  any  event,  the  meaning 
of  "peaceful  use"  of  outer  space  is  unsettled,^^  and,  with  its  often  nonlethal,  physically 
nonintrusive  character,  it  is  possible  that  much  of  "information  warfare"  could  be 
considered  "peaceful. 
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Second,  for  the  Outer  Space  Treaty's  prohibition  against  orbital  weapons  of  mass 
destruction  to  apply,  it  would  first  have  to  be  determined  that  the  weapons  used  in  an 
information  warfare  attack,  particularly  an  electronically  based  one,  were  weapons  of 
mass  destruction.  Many  information  warfare  attacks,  which  may  have  no  direct  physical 
effects,  cannot  easily  be  considered  to  cause  mass  destruction  in  the  same  way  as  would, 
say,  an  atomic  bomb.  Furthermore,  assuming  that  the  weapons  of  information  warfare 
could  constitute  "weapons  of  mass  destruction,"  those  weapons,  even  when  they  use 
satellites,  might  not  be  considered  to  be  in  space.  For  example,  when  a  satellite  is  used  to 
transmit  a  signal  for  computer  intrusion  or  sabotage  or  in  communications  spooling,  the 
ultimate  "weapon  of  mass  destruction"  (the  originator  of  the  signal)  may  actually  be  on 
the  ground,  and  the  satellite  only  a  conduit  for  the  attack,  just  as  satellites  used  for 
guidance  of  intercontinental  ballistic  missiles  would  not  be  "weapons  of  mass 
destruction."^^ 

State  Practice 

State  practice,  itself  a  major  source  of  customary  international  law,^°  seems  to  permit 
much  of  what  would  go  into  information  warfare.  First,  espionage,  although  universally 
criminal  under  domestic  laws,  does  not,  by  itself,  violate  international  law.^' 
Furthermore,  orbital  remote  sensing,  which  may  include  the  bombardment  of  a  country's 
territory  with  radar  or  other  forms  of  electromagnetic  radiation,  is  permissible  during  war 
or  peace. 

Second,  an  adversary's  communications  are  recognized  as  legitimate  targets  for 
disruption  during  war.  Undersea  cables,  including  those  connecting  belligerents  with 
neutrals,  have  been  interfered  with  during  all  naval  wars  since  the  Spanish-American 
War,  as  Article  15  of  the  1884  Convention  for  the  Protection  of  Undersea  Cables  exempts 
belligerents.  For  example,  as  World  War  I  began  in  August  1914,  the  British  cableship 
Telconia  cut  Germany's  undersea  cables,  and  reeled  in  the  loose  ends  to  prevent  repair.^"^ 
Governments  have  conducted  radio  jamming  in  both  peace  and  war  for  over  60  years, 
beginning  with  Austria's  efforts  to  block  propaganda  broadcast  from  Nazi  Germany  in 
1934.^^  Finally,  ruses  have  been  part  of  warfare  for  millennia  and  their  legitimacy  has 
been  explicitly  recognized;^^  just  as  the  original,  ancient  Trojan  Horse  was  legal,  so  too 
might  be  some  "Trojan  Horse"  pieces  of  software. 

Major  Limitations  on  Information  Warfare 

Despite  the  novelty  of  some  information  warfare  techniques,  international  law  poses 
some  constraints  on  the  conduct  of  information  warfare,  just  as  it  does  on  the  traditional 
forms  of  warfare  that  use  kinetic  force  for  their  impact.  Nevertheless,  characteristics  of 
information  technology  and  warfare  pose  problems  to  those  who  would  use  international 
law  to  limit  information  warfare,  and  leave  legal  space  for  those  who  would  wage  such 
warfare. 

Neutrality  and  National  Sovereignty 

By  treaty  as  well  as  by  longstanding  customary  law,  the  territory  of  neutral  states  is 
supposed  to  be  inviolable  by  the  forces  of  belligerents.  Apparently,  then,  an  attack 
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through  a  network  that  crosses  neutral  territory,  or  using  a  neutral  country's  satellites, 
computers,  or  networks,  would  infringe  upon  that  neutral's  territory,  just  as  would  an 
overflight  by  a  squadron  of  bombers  or  an  incursion  by  armed  troops.  The  attack  would 
thus  be  considered  illegal  and,  perhaps,  an  act  of  war  against  the  neutral.^*  Conversely,  a 
neutral's  failure  to  resist  the  use  of  its  networks  for  attacks  against  another  country  may 
make  it  a  legitimate  target  for  reprisals  by  the  country  that  is  the  ultimate  target  of  the 
attacks. 

Although  the  argument  that  electronic  incursion  would  violate  neutrality  is  strong,  a 
counter-argument  exists.  The  encroachments  beyond  a  nation's  borders  that  may  violate 
its  neutrality  have,  in  the  past,  been  physical  intrusions  by  troops,  ships,  or  planes. 
Attacking  a  neutral's  networks,  satellites,  or  computers  might  not  violate  the  state's 
neutrality  because  it  might  involve  no  physical  encroachment  (and  might  not  even 
constitute  an  "attack"  in  the  first  place^^).  Significantly,  although  neutrals  must  not  allow 
any  belligerent  to  move  troops  or  supplies  through  their  territory,’®  or  to  erect  military 
radio  stations  there,’'  neutrals  have  no  such  obligation  to  prevent  belligerents  from  using 
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their  publicly  accessible  communications  equipment. 

Further,  as  a  practical  matter,  despite  an  unambiguous  rule  to  the  contrary,  belligerents 
have  quite  significantly  violated  prohibitions  against  the  erection  and  use  of  non-public 
military  communications  facilities  in  neutral  territory  for  military  purposes.  Thus,  the 
vitality  of  rules  regarding  neutrals  and  telecommunications  may  have  been  weakened,  as 
countries  have  acted  as  if  those  laws  did  not,  in  fact,  have  legal  force.  During  World  War 
II,  for  example,  belligerents  on  both  sides  took  advantage  of  the  neutrality  of  Portugal,  as 
well  as  perhaps  Turkey  and  Switzerland,  by  constructing  and  using  telecommunications 
facilities  for  military  purposes  within  those  states.’"'  In  sum,  it  is  not  obvious  whether  the 
use  of  a  neutral  nation's  computers,  networks,  and  communications  facilities  would 
violate  that  nation's  neutrality,  or  open  that  nation  up  to  belligerent  reprisals. 

International  Humanitarian  Law 

International  humanitarian  law  would  seem  to  welcome  the  nonlethal  "combat"  that 
information  warfare  promises,  but  that  body  of  law,  which  is  a  combination  of 
conventions  and  longstanding  customary  law,’^  may  constrain  information  warfare 
activities  as  it  does  traditional  warfare.  The  fundamental  principle  of  this  body  of  law  is 
that  the  permissible  methods  of  hurting  an  enemy  are  not  unlimited,  and  that  the  cruelty 
of  war  must  be  mitigated  and  circumscribed.”  Nevertheless,  although  that  principle 
unquestionably  survives,  even  if  it  is  sometimes  honored  only  in  the  breach,  it  is  not 
obvious  that  all  types  of  damage  that  information  attacks  would  inflict  are  the  kinds  of 
injuries  against  which  humanitarian  law  endeavors  to  protect. 

Although  humanitarian  law  protects  combatants  as  well  as  noncombatants,  the  most 
significant  relevant  general  tenet  of  humanitarian  law  is  the  protection  of  civilians.  This 
principle  was  codified  over  a  century  ago  in  the  St.  Petersburg  Declaration  of  1868, 
which  recognized  that  the  only  legitimate  object  of  war  was  to  weaken  an  enemy's 
military  forces.  Civilians,  as  such,  may  not  be  the  object  of  an  attack.  Much  of  the  law 
addressing  the  fate  of  civilians  stems  from  concern  over  artillery  bombardment,  and  later 
aerial  bombing,  as  that  was  how  civilians,  unless  they  were  loitering  near  a  battlefield. 
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were  most  likely  to  eome  under  fire,  and  it  eonsistently  plaees  eivilians  off  limits  for 

attaek.  Under  the  Hague  Convention  (IV)  of  1907,  military  forees  eould  not  attaek  or 

bombard  "by  whatever  means"  undefended  towns,  dwellings  or  buildings,  a  provision 

that  has  carried  over  into  the  charter  of  the  tribunal  considering  war  crimes  in  the  former 

Yugoslavia.  Similarly,  the  Charter  of  the  Nuremberg  Tribunal  condemned  wanton 
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bombing  of  civilian  targets. 

Despite  such  legal  protections,  the  reality  is  that  civilians  are  often  victims  of  modern 
warfare,  without  legal  consequences  for  those  who  hurt  them.  Nevertheless,  when  attacks 
are  planned  and  executed,  attackers  are  supposed  to  try  to  avoid  injuring  civilians,  even 
collaterally.  Attacks  are  to  be  directed  solely  toward  "military  objectives,"  which  have 
been  defined  (to  the  extent  such  a  definition  is  meaningful)  as  "those  objects  which  by 
their  nature,  location,  purpose,  or  use  make  an  effective  contribution  to  military  action 
and  whose  total  or  partial  destruction,  capture  or  neutralization,  in  the  circumstances 
ruling  at  the  time,  offers  a  definite  military  advantage."*^  To  the  end  of  confining  attacks 
to  military  objectives  and  limiting  civilian  casualties,  nations  may  not  use  weapons  that 
make  it  impossible  for  their  targeters  to  distinguish  between  civilian  and  military  targets 
(and  of  course,  the  targeters  must  make  such  distinctions).^^ 

The  planning  and  execution  of  attacks  must  also  include  considerations  of 
"proportionality"  between  civilian  damage  and  the  military  objective  attained. 
Proportionality  is  a  dual  doctrine,  arising  from  customary  international  law.  It  applies  to 
both  whether  a  given  level  of  force  is  appropriate  in  response  to  a  particular  grievance  (as 
part  of  the  law  of  the  use  of  force,  or  jus  ad  helium), and  whether  a  given  action  is 
appropriate  in  light  of  its  objectives  and  the  casualties  that  will  result  (as  part  of  the  law 
of  armed  conflict,  or  jus  in  hello).  In  the  context  of  humanitarian  concern, 
proportionality  derives  in  part  from  the  Christian  "just  war"  doctrine.  Commanders  must 
minimize  civilian  casualties,  subject  to  the  need  to  accomplish  a  particular  military 
mission,  and  they  must  weigh  the  cost  of  civilian  lives  against  the  benefit  to  be  gained  by 
the  mission. 

On  its  face,  international  humanitarian  law  anticipates  technological  change  relatively 
well.  Even  though  some  information  warfare  weapons  and  techniques  could  not  even 
have  been  contemplated  when  the  humanitarian  legal  principles  were  developed,  those 
principles  can  still  apply.  The  "Martens  Clause,"  which  has  been  a  part  of  major 
humanitarian  conventions  since  1899,  asserts  that  even  in  cases  not  explicitly  covered  by 
specific  agreements,  civilians  and  combatants  remain  under  the  protection  and  authority 
of  principles  of  international  law  derived  from  established  custom,  principles  of 
humanity,  and  from  the  dictates  of  public  conscience,  and  that  they  are  not  left  to  the 
arbitrary  judgment  of  military  commanders.  In  other  words,  for  purposes  of 
humanitarian  law,  attacks  will  be  judged  largely  by  their  effects,  rather  than  by  their 
methods. 

Despite  its  apparent  flexibility  in  coping  with  technological  change,  international  law 
may  not  easily  deal  with  information  warfare.  It  seems  obvious  that  information  warfare 
attacks  that  were  the  direct  and  intentional  cause  of  noncombatant  death  and  destruction- 
such  as  disruption  of  an  air  traffic  control  system  that  caused  a  civilian  airliner  to  crash. 


11 


or  corruption  of  a  medical  database,  eausing  eivilians  or  wounded  soldiers  to  reeeive 
transfusions  of  the  ineorreet  blood  type-eould  violate  the  laws  of  war.^^  It  is  less  obvious 
that  attaeks  with  less  tangible  results,  sueh  as  the  disruption  of  a  finaneial  or  soeial 
security  system,  or  the  diselosure  of  eonfidential  personal  information,  eonstitute  the  sort 
of  injury  against  whieh  humanitarian  law  is  supposed  to  proteet  eivilians,  even  though  for 
some  vietims,  the  eonsequenees  of  disruption  of,  say,  the  banking  system,  eould  be  more 
painful  than  a  bombing  that  damaged  a  dwelling. 

In  eonsidering  whether  information  attaeks  against  civilians  may  violate  humanitarian 
law,  it  is  important  to  remember  that  all  wars  cause  suffering  for  eivilians,  ranging  from 
deprivations  as  resourees  must  be  diverted  to  military  purposes,  to  disruption  of 
government  serviees,  to  destruetion  of  buildings  and  loss  of  life,  to  outright  mass 
starvation,  without  apparent  legal  eonsequenees,  and  often  with  the  law's  blessing. 
Indeed,  although  the  legality  of  sueh  a  strategy  might  now  be  questioned,  the  starvation 
of  the  Japanese  population  was  part  of  the  U.S.  naval  strategy  in  World  War  II.  Similarly, 
the  hardship  imposed  on  Iraqi  eivilians  by  the  U.S.  and  UN  embargo  against  Iraq  was 
supposed  to  either  influenee  Saddam  Hussein  or  eonvinee  the  Iraqi  people  to  overthrow 
him. 

The  dual-use  nature  of  many  teleeommunieations  networks  and  mueh  equipment  further 
eomplieates  the  questions  of  the  applieability  of  humanitarian  law  as  a  eonstraint  on 
information  warfare.  These  dual  uses  eontribute  to  the  blurring  of  the  distinetion  between 
military  and  civilian  systems  and,  eonsequently,  between  military  targets,  whieh  are 
legitimate,  and  eivilian  ones,  whieh  are  not.  Some  information  weapons  may  thus  not 
permit  their  users  to  distinguish  between  military  and  eivilian  targets.  In  the  United 
States,  for  example,  it  has  been  estimated  that  95%  of  the  teleeommunieations  of  the 
Department  of  Defense  travel  through  the  Publie  Switehed  Network,^®  and  during  the 
Persian  Gulf  War,  eommereial  eommunieations  satellites  reportedly  earried  almost  a 
quarter  of  the  U.S.  Central  Command's  transeontinental  teleeommunieations.^^ 
Additionally,  U.S.  military  forees  are  partieularly  dependent  upon  non-military  systems 
for  deployment  and  logisties.^^  Attaeks  with  military  objeetives  might  thus  neeessarily  be 
direeted  at  predominantly  eivilian  systems,  with  eorresponding  injury  to  the  eivilians  who 
depend  upon  them.^^  As  Viee  Admiral  Arthur  Cebrowski  stated  in  1995,  "There  is  no 
logical  distinction... between  military  or  civil  systems  or  teehnologies.  [Therefore]  there  is 
also  no  teehnieal  distinetion  between  exploitation,  attaek  or  defense  of  the  information 
warfare  target  set."^"^ 

The  interdependenee  and  intereonneetivity  of  eivilian  and  military  systems  may  further 
exacerbate  the  difficulty  in  distinguishing  among  civilian  and  military  targets.  Attacks 
directed  at  predominantly  military  targets  may  eause  eivilian  systems  that  are  eonneeted 
to  those  military  systems  to  fail;  alternatively,  a  virus  that  is  direeted  toward  an 
adversary's  military  systems  may  spread,  inadvertently  or  otherwise,  into  eivilian  (and 
even  friendly)  systems.  Furthermore,  attacks  on  systems  that  would  otherwise  be 
legitimate  targets  may  be  impermissible  beeause  of  the  danger  to  eivilians  that  system 
malfunetions  might  eause.  For  example,  an  attaek  on  a  military  power  faeility  might  pose 
problems  if  that  facility's  failure  eould  release  dangerous  materials  into  the  atmosphere. 
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Manipulating  Enemy  Perceptions 

Spurring  Internal  Turmoil.  Techniques  such  as  video  morphing  and  communications 
spoofing  may  make  it  possible  for  a  country  to  manipulate  the  perceptions  of  its 
adversary's  leaders  and  populace.  The  country  may  spread  confusion  or  disaffection  by 
covertly  altering  official  announcements  or  news  broadcasts,  or  it  may  confuse  or 
frighten  leaders  by  spoofing  intelligence  or  other  government  communications.  In 
principle,  these  actions  would  not  violate  the  laws  of  war. 

Taken  to  the  extreme,  however,  manipulation  of  news  or  intelligence  in  certain  cases 
might  be  considered  the  proximate  cause  of  genocide  or  other  atrocities.  As  Colonel 
Richard  Szafranski  has  suggested,  manipulating  an  adversary  nation  to  the  extent  that  its 
citizens  or  leaders  become  unhinged  from  reality,  especially  when  the  effects  cannot  be 
known  or  controlled,  may  be  no  less  wrongful  than  to  force  another  nation  into  starvation 
or  cannibalism.^^  The  potentially  dangerous  results  of  perception  manipulation  are  more 
than  theoretical.  Some  observers  believe  that  "hate  radio"  contributed  to,  or  even  sparked, 
genocide  in  Rwanda  and  the  former  Yugoslavia.  The  use  of  propaganda,  "video 
morphing,"  or  deceptive  broadcasts  to  the  extent  that  they  spur  unrestrained  civil  war,  or 
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even  genocide,  may  thus  be  illegal. 

Perfidy.  Although  ruses  are  unquestionably  permissible  in  war,  not  all  acts  of  deception 
are.  Certain  acts  of  treachery  or  "perfidy"  are  forbidden  by  longstanding  customary  law 
and  by  several  conventions.  While  ruses  (such  as  the  threatened  U.S.  Marine  landing  in 
Kuwait  during  the  Persian  Gulf  War)  are  acts  planned  to  mislead  an  enemy,  as  by  causing 
him  to  become  reckless  or  choose  a  particular  course  of  action,  perfidious  acts  are 
designed  to  convince  the  enemy  that  the  actor  is  entitled  to  protected  status  under  the  law 
of  war,  with  the  intent  of  betraying  that  confidence.  Perfidious  acts  include  feigning  a 
truce  or  surrender,  injury  or  incapacitation,  civilian  status,  or  other  protected  status,  such 
as  that  of  UN  or  neutral  forces,  for  purposes  of  attacking  the  enemy.^^  Similarly, 
attacking  while  wearing  the  enemy's  uniform  is  prohibited. 

Information  warfare  attacks  that  involve  distorting  enemy  perceptions  may  be  limited  by 
prohibitions  against  perfidy.  For  example,  manipulating  enemy  visual,  sensing,  or  other 
information  systems  so  that  enemy  forces  wrongly  believe  that  U.S.  troops  are 
surrendering  would  certainly  seem  perfidious,  as  would  causing  them  to  believe  that  U.S. 
combat  vehicles  were  medical  vehicles  or  those  of  neutrals.  Similarly,  manipulating  an 
enemy's  targeting  database  so  that  it  believed  that  a  U.S.  division  headquarters  was  a 
hospital  would  be  wrong.  Less  obviously,  manipulating  identification  signals  so  that  a 
nation's  forces  believe  that  the  enemy  personnel  or  vehicles  that  are  approaching  are 
actually  friendly  forces  would  arguably  come  under  the  norm  underlying  the  prohibition 
against  attacking  while  wearing  enemy  uniforms.  On  the  other  hand,  because  of  the 
longstanding  view  that  communications  may  be  disrupted,  and  because,  unlike  uniforms, 
information  systems  are  in  no  way  required  by  the  laws  of  war  but  are  rather  combat  aids, 
such  tactics  might  seem  less  treacherous  than  would  taking  advantage  of  the  requirement 
that  troops  wear  distinct  uniforms  to  set  themselves  off  from  their  foes  and  civilians. 
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"Peacetime"  Use  of  Information  Warfare  and  Problems  of  Definition 
Is  Information  Warfare  "Warfare"? 

Definitions  and  Prohibitions .  A  side-effect  of  technological  change  is  that  the  new 

activities  that  it  enables  may  not  fit  within  established  legal  categories.  For  example, 

aerial  surveillance  has  historically  been  restricted  by  the  sovereignty  of  each  state  over  its 

airspace.  The  development  of  satellite  and  space  technology  in  the  1950s  later  enabled 

surveillance  from  orbit.  Although  such  orbital  surveillance  was  functionally  the  same  as 

aerial  surveillance,  international  law  has  chosen  to  consider  it  as  a  distinct  activity, 

subject  to  the  universal  freedom  of  actions  in  space.  This  characterization  was  not 

obvious  or  required  by  contemporary  understandings  of  international  law;  more  likely, 

most  countries  who  wanted  to  apply  traditional  understandings  of  sovereignty  to  orbital 
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surveillance,  such  as  several  African  states,  lacked  the  capacity  to  do  anything  about  it. 

A  fundamental  threshold  question  that  arises  from  the  development  of  information 
warfare  techniques  is  thus  the  definitional  one.  Has  the  development  of  information 
warfare  technology  and  techniques  taken  information  warfare  out  of  the  existing  legal 
definition  of  war?  Simply,  it  is  not  obvious  that  all  information  warfare  attacks,  including 
some  that  would  inflict  serious  hardship  upon  their  targets,  are  what  has  previously  been 
included  within  our  understanding  of  "war."  Similarly,  the  "damage"  that  such  attacks 
would  inflict,  particularly  upon  civilians,  may  not  be  the  sort  of  hardship  that  the 
historical  and  conventional  laws  of  war  were  intended  to  alleviate.  Consequently,  there 
may  be  confusion  over  what  limits  may  apply  to  the  conduct  of  information  warfare,  and 
when  information  warfare  attacks  may  be  carried  out. 

War,  as  we  have  traditionally  understood  it,  inherently  includes  armed  forces,  force,  and 
violence. The  efforts  of  the  United  Nations  to  pursue  a  more  peaceful  world  are 
instructive  on  this  point.  Article  2(4)  of  the  UN  Charter,  for  example,  forbids  the  threat  or 
use  of  force  against  the  territorial  integrity  or  political  independence  of  another  state.  This 
prohibition  has  been  applied  only  to  physical  force  since  the  drafting  of  the  Charter.  Most 
relevantly,  the  United  States  and  its  allies  have  understood  the  provision  as  not  applying 
to  economic  coercion,  although  many  questioned  that  view  during  the  1973  Arab  oil 
embargo.  Further,  during  the  drafting  of  the  Charter,  when  Brazil  proposed  including 
"economic  measures"  with  "force,"  the  proposal  was  rejected  by  a  vote  of  26-2.'°^ 
Consistently,  Article  51  of  the  Charter  recognizes  a  state's  right  to  use  force  in  self- 
defense  against  an  "armed  attack." 

Although  lacking  some  of  the  formal  legal  authority  of  the  Charter,  the  United  Nations 
General  Assembly's  declaration  defining  "aggression"  also  reveals  explicit  contemplation 
of  armed  forces  or  military  might.  The  declaration  defines  aggression,  which  the 
Security  Council  is  empowered  to  address, as  "the  use  of  armed  force  by  a  State 
against  the  sovereignty,  territorial  integrity  or  political  independence  of  another  State,  or 
in  any  other  manner  inconsistent  with  the  Charter  of  the  United  Nations. The  first  use 
of  armed  force  by  a  state  would  constitute  prima  facie  evidence  of  aggression.''^  The 
declaration  sets  out  the  following  as  a  non-inclusive  list  of  those  acts  that  would  qualify 
as  aggression: 
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•  The  invasion  or  attack  by  the  armed  forces  of  a  state  of  the  territory  of  another 
state,  or  any  military  occupation,  however  temporary,  resulting  from  such 
invasion  or  attack,  or  any  annexation  by  the  use  of  force  of  all  or  some  of  another 
state's  territory. 

•  Bombardment  by  the  armed  forces  of  a  state  against  the  territory  of  another  state 
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or  the  use  of  any  weapons  by  a  state  against  the  territory  of  another  state. 

•  The  blockade  of  the  ports  or  coasts  of  a  state  by  the  armed  forces  of  another  state. 

•  An  attack  by  the  armed  forces  of  a  state  on  the  land,  sea,  or  air  forces,  or  marine 
and  air  fleets  of  another  state. 

•  The  use  of  armed  forces  of  one  state  which  are  within  the  territory  of  another  state 
with  the  agreement  of  the  receiving  state,  in  contravention  of  the  conditions 
provided  for  in  the  agreement  or  any  extension  of  their  presence  in  such  territory 
beyond  the  termination  of  the  agreement. 

•  The  action  of  a  state  in  allowing  its  territory,  which  it  has  placed  at  the  disposal  of 
another  state,  to  be  used  by  that  other  state  for  perpetrating  an  act  of  aggression 
against  a  third  state. 

•  The  sending  by  or  on  behalf  of  a  state  of  armed  bands,  groups,  irregulars  or 
mercenaries,  which  carry  out  acts  of  armed  force  against  another  state  of  such 
gravity  as  to  amount  to  the  acts  listed  above,  or  its  substantial  involvement 
therein. 

Other  legislative  practice  of  the  United  Nations  reinforces  the  view  that  "aggression"  is 
limited  to  the  use  of  force.  In  1953  Iran  pressed  the  United  Nations  for  an  understanding 
that  any  act  serving  the  same  ultimate  purposes  as  an  armed  attack  or  involving  coercion 
to  endanger  independence  was  "aggression,"  but  the  United  Nations  has  never  adopted 
that  view.^'"^ 

Further  affirming  the  kinetic  view  of  war  is  the  definition  of  "attacks"  as  enunciated  in 
the  1977  Additional  Protocol  to  the  Geneva  Convention.  That  document,  which  the 
United  States  has  signed  but  not  ratified,  embodies  much  customary  international  law.''^ 
It  defines  "attacks"  as  "acts  of  violence  against  the  adversary,  whether  in  offense  of 
defense. Additionally,  the  issue  of  whether  an  information  warfare  attack  constitutes 
"armed  attack"  for  purposes  of  self-defense  under  the  UN  Charter  is  discussed  in  Part  III. 

Some  forms  of  attack  under  the  information  warfare  rubric  fit  comfortably  within  the 
above  definitions  of  war,  force,  aggression,  and  attack.  For  example,  the  use  of  precision- 
guided  munitions  against  a  military  communications  post  could  certainly  constitute  war. 
Although  the  disruption  of  a  social  security  system  database  through  the  use  of  a  virus  or 
hacking  during  hostilities  could  certainly  be  part  of  a  war,  it  is  less  obvious  that  such 
attacks  would  by  themselves  constitute  acts  of  war,  because  of  their  nonlethal, 
nondestructive  (in  a  direct,  physical  sense),  non-physically  intrusive  character. 
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On  the  other  hand,  it  is  eertain  that  a  state  of  "war"  ean  exist  in  the  absenee  of  what  we 
have  traditionally  understood  as  fighting.  Wars  do  not  always  end  simultaneously  with 
the  eessation  of  eombat;  rather  they  generally  may  require  some  sort  of  elosure,  both  for 
international  and  domestie  legal  purposes.  For  example,  the  United  States  did  not  give 
up  its  status  as  a  belligerent  in  World  War  I  until  1921,  even  though  fighting  eeased  in 
1918;  World  War  II  did  not  end  for  several  eountries  until  well  after  1945;  and  Israel 
and  its  Arab  foes  have  endured  years  of  largely  eombatless  war.  Conversely,  although 
formal  deelarations  of  war  are  virtually  nonexistent  in  the  modern  era,  nations  eould 
eertainly  deelare  war  on  eaeh  other  without  aetually  engaging  in  battle. 

Where  the  applieability  of  a  prineiple  of  law  is  not  immediately  aseertainable,  it  is  often 
helpful  to  examine  the  intent  underlying  that  legal  prineiple  or  statute.  Unfortunately,  that 
intent  is  insuffieiently  instruetive. 

The  fundamental  doeument  of  the  modern  international  legal  system  is  the  Charter  of  the 
United  Nations,  whieh  was  signed  in  San  Franeiseo  in  1945.  Aeeording  to  the  Charter's 
Preamble,  the  aim  of  the  United  Nations'  founders  was,  in  relevant  part,  "to  save 
sueeeeding  generations  from  the  seourge  of  war,  whieh  twiee  in  our  lifetime  has  brought 
untold  sorrow  to  mankind."''^  To  pursue  those  ends,  the  founders  resolved  to: 

•  praetiee  toleranee  and  live  together  in  peaee  with  one  another  as  good  neighbors, 
and 

•  unite  our  strength  to  maintain  international  peaee  and  seeurity,  and 

•  ensure  by  the  aeeeptanee  of  prineiples  and  the  institution  of  methods,  that  armed 
foree  shall  not  be  used  save  in  the  eommon  interest,  and 

•  employ  international  maehinery  for  the  promotion  of  the  eeonomie  and  soeial 
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advaneement  of  all  peoples. 

The  stated  purposes  of  the  United  Nations  are: 

1.  To  maintain  international  peaee  and  seeurity,  and  to  that  end:  to  take  effeetive 

eolleetive  measures  for  the  prevention  and  removal  of  threats  to  the  peaee,  and  for 

the  suppression  of  aets  of  aggression  or  other  breaehes  of  the  peaee,  and  to  bring 

about  by  peaeeful  means,  and  in  eonformity  with  the  prineiples  of  justiee  and 

international  law,  adjustment  or  settlement  of  international  disputes  or  situations 
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whieh  might  lead  to  a  breaeh  of  the  peaee; 

2.  To  develop  friendly  relations  among  nations  based  on  respeet  for  the  prineiple  of 
equal  rights  and  self  determination  of  peoples;  and 

3.  To  aehieve  international  eooperation  in  solving  international  problems  of  an 

123 

eeonomie,  soeial,  eultural  or  humanitarian  eharaeter. 

Members  of  the  United  Nations,  and  the  organization  itself,  are  pledged  to  aet  in 
aeeordanee  with  the  following  relevant  prineiples: 
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All  members  shall  settle  their  international  disputes  by  peaeeful  means  in 
sueh  a  manner  that  international  peaee  and  seeurity,  and  justiee,  are  not 
endangered;  and 

All  members  shall  refrain  in  their  international  relations  from  the  threat  or 
use  of  foree  against  the  territorial  integrity  or  politieal  independenee  of 
any  state,  or  in  any  other  manner  inconsistent  with  the  Purposes  of  the 
United  Nations. 

The  UN  General  Assembly  has  set  out  its  interpretations  of  nations'  obligations  under  the 
Charter.  The  Declaration  of  Principles  of  International  Law  Concerning  Friendly 
Relations  and  Co-operation  Among  States  in  Accordance  with  the  Charter  of  the  United 
Nations  opposes  all  forms  of  coercion,  including  economic  pressure  against  a  state  "to 
obtain  from  it  the  subordination  of  the  exercise  of  its  sovereign  rights."  In  a  similar 
vein,  the  General  Assembly  also  set  out  a  Declaration  on  the  Inadmissibility  of 
Intervention  into  the  Domestic  Affairs  of  States,  which  included  similar  language  against 
the  subordination  of  sovereign  rights,  and  asserted; 

No  State  has  the  right  to  intervene,  directly  or  indirectly,  for  any  reason 
whatsoever,  in  the  internal  or  external  affairs  of  any  other  State. 
Consequently,  armed  intervention  and  all  other  forms  of  interference  or 
attempted  threats  against  the  personality  of  the  State  or  against  its 
political,  economic  and  cultural  elements,  are  condemned; 

The  problem  in  using  the  fundamental  principles  laid  out  in  these  declarations  as  tools  in 

interpreting  whether  the  prohibitions  on  the  use  of  armed  force  would  apply  to  certain 

forms  of  information  warfare  is  that  to  do  so  would  be  to  rely  upon  reasoning  that  is 

either  circular  or  demonstrably  unrealistic.  For  example,  the  UN  Charter  language  about 

the  "scourge  of  war,"  "threats  to  the  peace,"  "respect  for...mtemational  law,"  preventing 

the  use  of  "armed  force,"  settlement  of  intemational  disputes  through  "peaceful  means," 

and  refraining  "from  the  threat  or  use  of  force"  is  only  relevant  to  nonlethal  information 

warfare  attacks  if  we  have  already  established  that  the  information  warfare  attacks  are, 

indeed,  "war,"  "force,"  "unpeaceful  means,"  or  whatever  other  term  would  apply  to 

something  we  would  be  trying  to  forbid.  Similarly,  the  Friendly  Relations  declaration's 

prohibition  of  the  use  of  coercion  to  force  the  subordination  of  the  exercise  of  a  state's 

"sovereign  rights"  applies  only  to  the  extent  that  we  have  determined  that  the  information 

warfare  attack  violates  those  sovereign  rights,  which  are  nowhere  defined.  To  read  the 

128 

provision  otherwise  would  be  to  forbid  diplomacy  or  other  forms  of  inducements. 

Finally,  the  declaration  on  intervention  does  not  really  define  intervention,  and  in  any 
event,  does  not  equate  nonmilitary  intervention  with  aggression  or  the  use  of  force,  thus 
leaving  room  for  attackers  to  defend  their  conduct.  Indisputably,  although  virtually  all 
states  purport  to  recognize  the  norm  of  nonintervention,  intervention  of  various  kinds 
occurs  frequently,  without  constituting  aggression  or  war.  The  declaration  thus  leaves  us 
with  no  principled  way  to  place  information  attacks  along  a  continuum  of  intervention 
stretching  from  a  nation's  leader  publicly  meeting  with  one  candidate  in  a  neighboring 
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country's  election,  to  funding  of  foreign  politieal  parties,  to  bribing  government  officials, 
to  arming  dissidents,  to  bombing  military  or  poliee  installations/^^ 

Relianee  upon  exhortations  to  eooperative  or  friendly  behavior  as  aids  in  interpreting  the 
applieability  of  the  prohibitions  on  the  use  of  foree  to  information  warfare  would  also 
require  cireular  reasoning  and  disregard  aetual  state  practiee,  which  is  itself  a  souree  of 
international  law.  None  of  these  doeuments  mandates  a  unified,  eonsistently 
harmonious  world.  Beeause  the  United  Nations  was  established  to  promote  the  peaeeful 
resolution  of  confliet,  it  implieitly  assumes  that  eonfiict  will  arise,  and  that  nations  will 
use  various  means  to  resolve  them.  Information  warfare  teehniques  are  thus  inappropriate 
to  resolve  eonfliets  only  if  it  is  determined  that  they  are  not  peaeeful  means,  the  very 
determination  the  provisions  should  help  us  to  make. 

The  Ability  of  States  to  Hurt  Each  Other.  It  is  important  to  remember  that  merely  beeause 
a  government  action  weakens  another  eountry's  military  forees  or  hurts  its  people,  does 
not  make  that  aetion  an  aet  of  war,  aggression,  or  foree.  Longstanding  international 
praetiee  reeognizes  that  nations  may  infiiet  great  hardship  upon  eaeh  other  and  their 
respective  eitizenries  without  such  infliction  constituting  the  use  of  force  or  a  violation  of 
international  law.  In  the  absenee  of  any  international  agreement,  nations  have  no 
underlying  legal  obligation  to  deal  with  eaeh  other.  A  government  may  thus  legally 
withhold  a  resouree,  sueh  as  fuel,  food,  or  even  medieine,  without  whieh  the  population 
of  another  nation  might  suffer  severely.  A  country  may  even  pressure  others  not  to  deal 
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with  a  third  eountry. 

Eeonomic  boyeotts,  embargoes,  and  other  sanetions  have  been  eommon  tools  of 
international  eoereion  in  the  twentieth  eentury,  espeeially  after  World  War  II.  Countries 
of  virtually  all  politieal  persuasions  have  tried  to  use  the  infliction  of  hardship  as  a  way  to 
convince  governments  to  amend  polieies.  For  example,  in  1908  the  Ottoman  Empire 
boyeotted  all  goods  from  Austria-Hungary  in  response  to  that  nation's  annexation  of 
Bosnia  and  Herzegovina.'^"^  In  1948,  the  Council  for  Mutual  Economic  Assistance 
(COMECON)  imposed  a  boyeott  on  trade  with  Yugoslavia  after  the  rift  between 
Marshals  Stalin  and  Tito.  The  United  States  and  United  Kingdom  organized  an 
international  boyeott  of  Iranian  oil  after  the  short-lived  government  of  Mohammed 
Mossedegh  nationalized  Iran's  oil  industry  in  1951.  Finally,  in  the  decades  following 
the  1948  Arab-Israeli  war,  the  Arab  Eeague  instituted  primary,  secondary,  and  tertiary 
boyeotts  against  Israel,  against  eompanies  that  did  business  with  Israel,  and  against 
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eompanies  that  did  business  with  eompanies  that  did  business  with  Israel. 

Similarly,  where  it  has  not  internationalized  a  eanal,  the  eountry  through  whieh  a  eanal 
travels  may  close  that  waterway  to  other  nations,  even  when  doing  so  would  hurt  those 
who  depend  upon  the  shipping  that  must  travel  through  it.  Furthermore,  states  have 
routinely  praetieed  "dirty  trieks"  against  eaeh  other,  ranging  from  eeonomie  espionage  to 
sabotage  of  exports  and  imports  and  beyond,  with  few,  if  any  international  legal 
repereussions.'^^ 

The  Significance  of  Armed  Force.  Comparison  of  information  warfare  attaeks  and  naval 
bloekades  may  be  instruetive  for  understanding  the  possible  plaee  of  information  warfare 
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under  international  law.  As  diseussed  above,  it  is  not  obvious  whether  nonlethal  attacks 
that  are  neither  physically  intrusive  nor  physically  destructive  would  constitute  acts  of 
"war,"  "force,"  or  "aggression."  Naval  blockades,  in  contrast,  are  recognized  as  forceful 
and  potentially  aggressive  acts,  even  though  some  effective  blockades  may  be  nonviolent, 
as  ships  either  avoid  the  blockaded  ports  or  are  diverted  peacefully. 

The  effects  of  naval  blockades  and  information  warfare  attacks  can  be  similar.  Naval 
blockades  prevent  the  transport  of  people  and  products  into  the  target  country  or  area,  and 
may  paralyze  an  economy.  In  the  past,  where  intercontinental  communication  was  largely 
by  ship,  a  blockade  would  keep  out  information  as  well.  An  information  warfare  attack 
may  also  make  transport  of  people  and  products  impossible,  paralyzing  an  economy,  and 
it  too  may  block  the  spread  of  information  (especially  as  in  an  "infoblockade"). 

The  primary  distinctions  then  between  a  naval  blockade  and  some  information  attacks 
might  be  that  the  blockade  is  executed  by  military  forces  and  includes  the  threat  (or 
actual  use)  of  physical  military  force,  while  the  information  warfare  attack  may  be 
executed  by  military  or  civilian  personnel  and  contains  no  physical  component  or  threat. 
The  relevance  of  these  distinctions  will  be  significant  for  the  treatment  of  information 
warfare  under  international  law. 

In  sum,  international  law  seems  to  draw  a  strong  distinction  between  traditional,  kinetic 
force  and  the  infliction  of  hardship  or  suffering  on  a  government  or  population.  Without 
getting  overly  philosophical  about  the  meaning  of  "violence,"  the  experience  of  the 
United  Nations  and  United  States  in  Iraq  is  instructive.  The  United  Nations  has  enforced 
an  embargo  against  Iraq  since  1990,  with  reportedly  devastating  effects  on  the  Iraqi 
population  and  economy.  During  that  time  period,  the  armed  forces  of  UN  members, 
mostly  the  United  States,  have  taken  military  action  on  several  occasions,  but  only  in 
response  to  specific  perceived  Iraqi  provocations,  such  as  the  planned  assassination  of 
former  U.S.  President  George  Bush  or  the  launching  of  missiles  at  U.S.  planes  enforcing 
a  no-fly  zone.  If  this  distinction  between  the  use  of  physical  force  and  the  infliction  of 
hardship  is  legally  valid,  nonviolent  information  attacks  may  not  be  considered  to  be 
"war,"  and  thus  might  not  be  subject  to  the  legal  constraints  that  govern  warfare. 

The  Importance  of  Categorization 

The  issue  of  how  to  categorize  information  warfare  attacks  is  of  more  than  academic 
interest.  First,  whether  or  not  an  information  warfare  attack  can  be  considered  an  act  of 
"war,"  "force,"  or  "aggression"  is  relevant  to  whether  a  forceful  response  can  be  justified 
as  self-defense,  as  well  as  to  the  issue  of  whether  a  particular  response  would  be 
proportionate  to  the  original  attack.'"^'*  Conversely,  whether  an  information  warfare  attack 
can  be  considered  the  use  of  force  goes  to  the  attack's  legality  as  a  coercive  measure  in 
"peacetime."  If  a  computer  or  communications  intrusion  or  manipulation  is  considered 
the  use  of  force  (as  in,  say,  a  naval  blockade  or  the  bombing  of  a  radar  facility),  then  it 
could  be  an  illegitimate  tool  of  international  coercion.  But  if  it  is  the  rough  equivalent  of, 
say,  trade  sanctions,  then  it  might  be  appropriate  in  a  peaceful  context.  Additionally, 
characterization  of  an  action  as  "war"  would  affect  the  rights  and  responsibilities  of 
nations  that  are  neutral  in  the  ongoing  conflict. 
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Finally,  characterization  of  attacks  and  the  damage  they  eause  is  relevant  to  the  status  of 
those  attaeks  under  international  humanitarian  law,  specifieally  those  provisions  that 
proteet  noncombatants  from  attacks  and  the  consequenees  thereof.  First,  if  an  information 
warfare  attaek  is  not  eonsidered  to  be  an  aet  of  "war,"  then  humanitarian  law  may  not 
apply;  the  attaek  could  be  eonsidered  to  be  equivalent  to  sueh  measures  as  elosing  a 
eanal,  or  refusing  to  trade,  the  sort  of  act  that  nations  appear  to  have  the  legal  right  to 
commit.  Second,  as  discussed  earlier,  it  is  not  settled  that  the  non-physical  or  indirect 
damage  that  some  information  warfare  attaeks  could  cause  are  the  sort  of  effeets  against 
whieh  humanitarian  law  proteets  noneombatants.  If  humanitarian  law  does  not  apply, 
then  countries  may  legally  pursue  information  warfare  without  (legal)  eoneern  for  the 
harm  that  civilians  might  suffer. 

Diffieulty  in  characterizing  certain  forms  of  information  warfare  as  "foree,"  "war,"  or 
"aggression"  under  international  law  does  not  mean  that  international  legal  institutions 
cannot  respond  to  sueh  attacks,  though.  For  example.  Chapter  VII  of  the  UN  Charter 
gives  the  UN  Seeurity  Council  the  authority  and  responsibility  to  determine  the  existenee 
of  any  "threat  to  the  peace"  or  aets  of  aggression, and  the  Couneil  can  recommend  and 
lead  responses  thereto. Many  information  attaeks  that  may  not  eonstitute  "foree"  or 
"aggression"  could  certainly  be  considered  threats  to  the  peace  and  thus  subjeet  to 
Seeurity  Couneil  action,  perhaps  ineluding  the  use  of  military  foree.  After  all,  anything 
that  would  anger  a  government  to  the  point  that  it  might  feel  the  need  to  resort  to  military 
action  could  thus  "threaten"  the  peaee,  even  if  the  provoeative  aetion  was  not  teehnically 
illegal.  Nevertheless,  because  any  Seeurity  Couneil  aetion  would  be  subjeet  to 
international  political  negotiation  and  maneuvering,  as  well  as  a  veto  by  one  of  the 
permanent  members  of  the  Couneil,  sueh  a  response  would  likely  not  be  quick,  sure,  or  a 
signifieant  deterrent  to  a  state  or  non-state  entity  that  was  considering  an  attack,  nor 
might  it  provide  solace  to  the  attack's  target. 
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Chapter  3:  Responding  to  Information  Warfare  Attacks: 
International  Legal  Issues  and  Approaches 

Attacks  Against  Information  Systems:  Methods  and  Motives 

Although  the  United  States  is  believed  to  lead  the  world  in  information  warfare 
eapability,  other  eountries  are  pursuing  sueh  eapabilities,  as  perhaps  are  transnational 
eriminal  organizations  or  terrorist  groups.  Beeause  of  the  pereeived  overwhelming 
traditional  military  might  of  the  United  States  and  its  allies,  and  beeause  international 
networks  may  offer  a  way  for  adversaries  to  strike  at  the  U.S.  homeland  without  needing 
the  sort  of  logistieal  and  military  eapabilities  that  a  traditional  attaek  would  require,  it 
seems  likely  that  the  United  States  or  one  of  its  teohnologieally  and  eoonomieally 
developed  allies  will  suffer  some  sorts  of  serious  information  warfare  attaeks.  If  such  an 
attack  comes,  the  United  States  (or  any  other  victim)  may  find  its  response  hindered,  as  it 
may  find  both  that  the  norms  arising  from  traditional  concepts  of  the  international  system 
of  sovereign  states  may  conflict  with  the  physical  reality  of  the  newly  wired  world,  and 
that  the  international  legal  system  may  not  yet  have  arrived  at  rules  applicable  to  such 
attacks.  The  United  States  may  thus  face  difficulty  in  tracing  an  attack  across  national 
boundaries,  gaining  authority  over  the  attackers,  and  determining  the  appropriate 
responses  the  attack. 

Other  observers  have  laid  out  in  detail  the  types  of  information  warfare  attacks  that 
adversaries  may  conduct  against  U.S.  security  facilities,  the  U.S.  homeland  or 
infrastructures,  or  the  facilities  of  other  countries. These  adversaries  may  include 
foreign  governments,  including  those  of  some  "friendly"  countries;  state-supported  or 
independent  terrorist  organizations,  which  may  be  international  in  composition  or  aim; 
transnational  criminal  organizations,  such  as  the  Russian  mafiya  or  Latin  American  drug 
cartels;  foreign  competitors  of  U.S.  companies;  domestic  terrorists  or  other  criminals;  or 
"hackers,"  who  conduct  mischief  of  varying  severity  using  computers,  telephones,  and 
networks. 

Such  attacks  may  be  part  of  armed  conflict  or  a  prelude  to  war.  They  may  constitute  a 
warning  or  threat  to  influence  a  government's  decision  makers  as  they  contemplate 
particular  courses  of  action.  They  may  be  part  of  an  economic  conflict,  either  between 
nations  or  between  corporations  (and  in  many  countries,  such  a  distinction  is  blurred). 
They  may  be  terrorism,  or  part  of  other  efforts  to  attract  attention  to  a  cause. They  may 
be  part  of  crime,  as  a  mechanism  of  theft  of  funds  or  valuable  data,  as  part  of  extortion,  or 
as  part  of  an  effort  to  hinder  law  enforcement.  Finally,  the  attacks  may  be  motivated  by 
perversity,  as  individuals  or  groups  attack  systems  because  they  can,  or  to  show  off,  or 
because  of  various  personal  shortcomings.''^^ 

Identification  Of  An  Attack 

The  first  dilemma  that  a  country  that  has  suffered  an  information  attack  may  face  in 
responding  to  the  attack  may  be  to  identify  an  event  as  an  actual  attack.  Especially  when 
an  attack  does  not  come  during  a  period  of  heightened  international  tensions,  it  may  be 
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difficult  for  investigators  to  distinguish  a  catastrophe  resulting  from  a  "natural"  or 
"accidental"  computer  error  from  one  stemming  from  malice. 

Physical  attacks  should  be  distinguishable  from  accidents  or  malfunctions,  as  the  culprits 
must  come  into  some  proximity  with  their  target,  and  they  may  leave  some  physical 
evidence  behind.  As  Aristide  Briand  said,  "A  cannon  shot  is  a  cannon  shot;  you  can  hear 
it  and  it  often  leaves  traces. But  even  so,  the  causes  of  catastrophes  may  be  hard  to 
ascertain,  especially  when  they  involve  complex  systems  that  may  not  be  fully 
understood.  For  example,  despite  exhaustive  investigations,  the  separate  but  similar 
crashes  of  two  Boeing  737  passenger  jets  remain  unexplained.'"^^  Furthermore,  and  most 
dramatically,  the  mystery  of  the  July  1996  crash  of  TWA  Flight  800  into  Long  Island 
Sound,  which  some  immediately  assumed  was  a  terrorist  incident,  remains  unsolved,  and 
investigators  did  not  publicly  rule  out  the  possibility  of  sabotage  until  May  1997. 

Computer-based  attacks  may  be  even  harder  to  distinguish  from  innocent  malfunctions.  If 
the  attack  is  carried  out  across  a  network,  the  culprits  may  never  be  physically  close  to 
the  target  (perhaps  never  entering  the  same  continent),  and  they  may  leave  no  tangible 
evidence.  Attacks  or  sabotage  using  viruses,  logic  bombs,  or  simply  buggy  software  may 
be  particularly  difficult  to  detect  quickly,  if  at  all,  because  of  the  complexity  of  systems 
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and  the  frequency  of  unintentional  errors  in  publicly  shipped  products. 

Software  errors  or  conflicts  are  known  or  suspected  to  have  caused  a  number  of  incidents 
that  might  have  seemed  to  be  intentional  attacks  on  important  systems,  products,  or 
weapons  by  criminals,  terrorists,  or  even  enemy  nations.  Perhaps  the  most  dramatic 
example  occurred  on  Martin  Luther  King  Day  in  1990,  when  the  AT&T  long  distance 
network  failed  for  nine  hours.  Although  the  actual  source  of  the  failure  was  ultimately 
attributed  to  a  faulty  software  update,  many  believed  that  hackers  had  actually  caused  the 
system  to  crash. Perhaps  more  frighteningly,  a  software  error  caused  a  Canadian 
nuclear  reactor  to  release  thousands  of  liters  of  radioactive  water  in  1990.'^*'  Similarly,  a 
timing  delay  in  targeting  software  caused  a  British  Royal  Air  Force  pilot  to  drop  a 
practice  bomb  on  a  British  aircraft  carrier  in  1992,'^'  and  it  has  been  suggested  that  the 
crashes  of  two  U.S.  Air  Force  F-117  fighters  in  identical,  suspicious  circumstances  were 
due  to  a  bug  in  their  software.  Systems  may  even  be  inadvertently  sabotaged  by  their 
creators.  For  example,  in  October  of  1994,  Adobe  Systems,  Inc.  accidentally  shipped  a 
"time  bomb"  in  a  version  of  its  popular  Photoshop  software  program.  The  time  bomb, 
which  was  to  cause  the  program  to  stop  running  after  a  particular  date,  had  been  inserted 
into  the  code  to  force  those  using  a  pre-release  version  of  the  program  to  upgrade  to  the 
final  shipping  version,  only  when  it  was  time  to  ship  the  product,  nobody  remembered  to 
take  it  out.'^^ 

An  incident  during  a  time  of  heightened  international  tensions  might  seem  to  present 
evidence  that  wrongdoing  is  afoot.  Nevertheless,  such  evidence  might  not  be  compelling 
alone,  as  times  of  stress  are  also  the  times  when  complex,  brittle  systems  may  be  most 
likely  to  break  down.'^"' 

The  difficulty  in  distinguishing  attacks  from  accidents  is  particularly  significant  in  light 
of  the  apparent  U.S.  preference  for  acting  under  the  auspices  of  international  coalitions. 
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Unless  the  United  States  is  prepared  to  act  alone,  the  evidence  it  uncovers  that  an  incident 
was  the  result  of  an  attack,  and  that  the  attack  stemmed  from  a  specific  source,  must  be 
sufficient  not  only  to  convince  U.S.  policymakers,  but  also  to  convince  foreign 
governments.  There  is  no  set  standard  of  proof  for  U.S.  officials  to  meet;  the 
deliberations  of  the  UN  Security  Council,  and  those  of  foreign  governments,  are  political 
rather  than  judicial.  Diplomacy,  including  carrots  and  sticks,  may  be  more  significant 
than  persuasive,  logical  arguments.  That  foreign  governments  may  be  skeptical  of  both 
U.S.  intentions  and  U.S.  technical  methods  of  detection  complicates  the  tasks  of 
investigators  and  policymakers  alike. 

After  extensive  investigation  of  the  explosion  of  Pan  Am  Flight  103  over  Lockerbie, 
Scotland,  in  December  1988,  for  example,  the  United  States  and  United  Kingdom  tried  to 
convince  the  Libyan  government  of  Muammar  Qadhafi  to  extradite  the  Libyan  agents 
who  were  allegedly  responsible  for  the  bombing.  In  their  efforts  to  obtain  UN  sanctions 
against  Libya  for  its  refusal  to  extradite  the  suspects,  they  presented  evidence  to  the  other 
members  of  the  UN  Security  Council,  which  held  meetings  in  camera,  with  no  public 
minutes  taken,  to  protect  the  confidentiality  of  the  evidence  and  the  Council's 
deliberations.'^^  Qadhafi  refused  to  extradite  the  suspects  and  demanded  that  the  United 
States  provide  him  with  evidence  to  support  its  charges,  which  he  mocked. Perhaps  to 
protect  intelligence  sources  and  methods,  the  United  States  refused  to  provide  Libya  with 
the  evidence. Despite  ongoing  sanctions,  Qadhafi  has  neither  acknowledged  the  value 
of  the  U.S.  evidence  nor  complied  with  the  Security  Council's  demands. 

Investigation  of  Network  Attacks  and  The  Problem  of  Territorial 
Jurisdiction 

Investigators  tracing  attacks  across  computer  networks  may  be  stymied  by  a  collision 
between  fundamental  principles  of  physics  and  those  of  international  law,  namely  that 
electrons  may  flow  through  networks  freely  across  international  borders,  but  the  authority 
of  agents  of  national  governments  does  not.  Simply,  an  attack  may  come  from  a  foreign 
country,  or  may  be  routed  through  computers  in  several  countries,  but  law  enforcement  or 
national  security  personnel  cannot  unilaterally  launch  pursuit  into  networks  in  other 
countries.  Under  the  principle  of  sovereignty  each  government  has  exclusive  authority 
over  events  within  its  borders. Investigators  will  thus  need  foreign  cooperation  or  help 
in  their  investigations  or,  with  proper  domestic  authorization,  they  will  need  to  operate 
covertly. 

Historically,  foreign  agents  have  not  been  permitted  to  operate  physically  on  a  state's 
territory  without  that  state's  permission. As  the  International  Court  of  Justice  held  in 
the  1949  Corfu  Channel  case,  when  Great  Britain  wanted  to  investigate  and  stop  the 
Albanian  mining  of  the  channel,  intervention  in  another  state  to  secure  evidence  is 
prohibited. 

Although  the  principles  of  sovereignty  were  conceived  when  international  law 
contemplated  only  physical  intrusions  into  a  nation's  borders,  national  governments 
would  probably  try  to  apply  the  principles  to  intrusions  into  computers,  networks,  or  data 
banks,  and  they  would  probably  succeed.  Individual  governments  have  already  exerted 
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authority  over  information  in  domestic  systems  just  as  they  would  if  it  had  physical  form; 

many  European  governments,  as  well  as  the  European  Elnion,  for  example,  have  enacted 

data  protection  codes  that  forbid  the  transport  or  transmission  of  certain  personal  data  to 

countries  (such  as  the  United  States,  perhaps)  that  do  not  provide  sufficient  protection  for 

that  data.'^^  Governments  may  thus  go  so  far  as  to  consider  the  act  of  investigation  by 

foreigners  of  criminal  misuse  of  their  systems  to  be  a  form  of  computer  crime,  or 
162 

worse. 

The  1994  intrusion  into  the  computers  at  the  U.S.  Air  Eorce's  Rome  Eaboratory  in  New 
Y ork  hinted  at  the  problem  of  the  collision  between  sovereignty  and  a  wired  world.  That 
spring,  two  hackers,  both  now  believed  to  have  been  British,  broke  into  and  took  control 
of  the  operational  network  at  the  U.S.  Air  Eorce's  command  and  control  research  facility 
at  the  Rome  Eabs.  Air  Eorce  investigators  were  observing  one  attacker  in  the  Rome 
computer  when  he  accessed  a  system  at  the  [South]  Korean  Atomic  Research  Institute, 
obtained  all  of  its  stored  data,  and  deposited  that  data  into  the  Rome  Eabs  system.  The 
investigators,  initially  fearing  that  the  system  belonged  to  North  Korea,  were  concerned 
that  the  North  Korean  government  would  interpret  the  intrusion  and  transfer  of  data  to  the 
U.S.  Air  Eorce  system  as  an  act  of  war,  at  a  time  of  sensitive  negotiations  with  North 
Korea  over  its  nuclear  weapons  program. 

Although  the  stronger  view  is  probably  that  government  agents'  intrusion  into  a  foreign 
computer  would  constitute  a  violation  of  the  target  nation's  sovereignty,  it  is  important  to 
note  that  not  all  electronic  crossing  of  boundaries  is  considered  that  way.  Eor  example, 
orbital  remote  sensing,  including  the  bouncing  of  such  signals  as  radar  off  a  country's 
territory,  is  now  so  universally  accepted  that  it  is  conducted  by  private  entities,  which 
may  sell  the  products  of  their  sensing  on  the  open  market. 

Eurthermore,  particularly  where  they  do  not  interfere  with  registered  stations,  countries 
have  no  obligation  to  keep  their  radio  broadcasts  from  penetrating  others'  borders. 
Weak  authority  even  supports  the  proposition  that  the  target  country  may  not  resist  such 
broadcasts  by  jamming.  Even  if  the  dubious  international  legality  of  unauthorized 
cross-border  electronic  intrusion  by  a  govemmenfs  agents  were  to  become  accepted, 
those  intrusions  could  still  violate  the  target  country's  domestic  laws,  if  any,  on  espionage 
or  computer  intrusion.  Just  as  it  would  be  hard  for  U.S.  authorities  to  exert  authority  over 
foreign  computer  attackers,  though,  foreign  governments  would  face  difficulty  in 
enforcing  their  laws  against  U.S.  agents  operating  from  computer  terminals  within  the 
United  States. 

The  conflict  between  international  networks  and  national  sovereignty  is  not  merely  an 
academic  one.  The  U.S.  Government  has  already  had  to  face  the  problem  of  pursuing 
foreigners  who  have  broken  into  U.S.  computer  systems  from  abroad  for  malicious 
purposes,  although  these  attackers  have  apparently  not  succeeded  in  causing,  or  have  not 
attempted  to  cause,  significant  destruction  or  denial  of  service.  Attackers  have 
complicated  U.S.  investigatory  efforts  by  "looping  and  weaving"  their  attacks  through 
several  foreign  countries  so  that  investigators  cannot  follow  the  trail.  Eor  example,  to 
stymie  tracing  efforts,  the  attackers  who  invaded  the  Rome  Eabs  computers  wove  their 
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way  through  phone  switches  in  Columbia  and  Chile  before  entering  Rome  Labs  through 
commercial  sites  in  the  United  States/^^ 

The  apparent  widespread,  inexpensive  availability  of  the  technology  necessary  for 
international  attacks  across  computer  networks,  combined  with  the  anonymity  that  the 
technology  may  provide  its  users,  may  complicate  the  efforts  of  investigators  to 
determine  whether  responsibility  for  an  attack  carried  out  by  an  individual  or  group  rests 
with  a  foreign  government,  and  would  certainly  make  it  more  difficult  to  convince  other 
nations  or  international  organizations  of  that  government's  role.  This  availability  could 
reduce  the  need  for  terrorists  or  similar  actors  to  seek  state  support.  It  should  also  give 
states  that  do  support  terrorism  claims  of  "plausible  deniability"  that  are  stronger  than 
those  of  states  that  have  supported  terrorism  in  the  past.  Conversely,  the  inexpensive, 
small,  and  ubiquitous  technology  may  make  it  harder  for  states  to  live  up  to  their 
obligation  to  prevent  their  territories  from  being  used  for  attacks  against  other  states.  As 
Paul  A.  Strassmann,  former  Director  of  Defense  Information  and  Principal  Deputy 
Assistant  Secretary  of  Defense  for  Command,  Control,  Communications  and  Intelligence, 
has  stated,  "Info-assassin  paraphernalia  is  booming,  and  it's  gory  stuff  you  can 
buy. ...There  is  also  a  wide  range  of  people  available  for  hire  to  carry  things  out,  many  of 
them  ex-intelligence  agency  people. 

The  tasks  of  investigators,  policymakers,  and  diplomats  are  made  harder  by  the 

uncertainty  that  arises  from  the  ability  of  users  (or  abusers)  of  computer  networks  to  hide 

their  identities  through  such  techniques  as  "spoofing"  so  that  others  may  be  blamed  for 

their  misdeeds.  In  fact,  absent  a  credible  admission  of  responsibility,  it  may  be  impossible 

to  attribute  an  attack  to  its  actual  source  with  any  degree  of  confidence.  This  uncertainty 
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may  have  ramifications  both  for  national  security  and  for  law  enforcement. 

Cooperation 

Further  complicating  nations'  attempts  to  trace  attacks  against  them  is  the  international 
investigatory  legal  regime,  or  lack  thereof.  First,  in  the  absence  of  a  treaty,  countries  have 
no  underlying  obligation  to  cooperate  with  each  other  in  their  law  enforcement  or 
national  security  investigations.  The  mere  fact  of  noncooperation  probably  cannot  be 
considered  evidence  of  implication  in  the  attack.  Even  where  they  had  no  involvement  in, 
or  sympathy  for,  an  attack,  hostile  or  indifferent  nations  may  be  unwilling  to  assist 
foreign  investigators,  whom  they  may  view  as  spies.  Even  largely  friendly  governments 
may  be  reluctant  to  cooperate,  often  for  domestic  political  reasons. 

International  law  enforcement  agreements  may  not  be  adequate  to  support  an 
investigation.  Eor  example,  treaties  of  mutual  legal  assistance,  which  may  institutionalize 
cooperation  between  countries'  law  enforcement  agencies,  generally  contain  exceptions 
that  permit  parties  to  refuse  cooperation  under  certain  circumstances,  such  as  to  protect 
"sovereignty,  security,  or  similar  essential  interests." In  the  context  of  computers, 
networks,  and  databases  that  may  implicate  a  country's  national  security  interests,  its 
technological  development,  security  of  its  financial  and  communications  infrastructure, 
or  the  privacy  of  its  citizens,  and  where  governments  may  not  feel  confident  about  their 
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ability  to  monitor  foreign  (especially  U.S.)  investigators'  activities,  some  nations  may 
likely  at  least  consider  taking  advantage  of  any  loopholes  they  can. 

Even  where  other  countries  are  cooperative,  mechanisms  of  international  cooperation, 
such  as  letters  rogatory,  may  be  prohibitively  slow,  particularly  given  the  speed  of 
communications  and  action  across  networks.  Furthermore,  and  perhaps  most 
significantly,  requesting  cooperation,  even  through  such  an  organization  as  Interpol,'^^ 
would  require  the  substantial  involvement  of  foreign  governments'  officials  and  could 
expose  them  to  information  about  the  victim's  intelligence  capabilities  or  the 
vulnerabilities  of  the  systems  and  networks  they  depend  upon. 

Given  the  difficulties  of  international  cooperation  discussed  above,  some  in  the  U.S. 
Government  may  advocate  that  it  unilaterally  pursue  its  investigation  without  the 
cooperation  of  countries  whose  computers  or  networks  have  been  used  for  attacks  against 
U.S.  systems.  Although  such  a  course  of  action  seems  likely  to  violate  the  sovereignty  of 
those  nations,  and  may  be  inconsistent  with  U.S.  responsibilities  under  individual  treaties 
of  legal  assistance,  it  would  not  in  itself  violate  international  law  any  further.  The 
investigation  would  probably  be  characterized  as  "espionage,"  which  does  not  violate 
international  law,  although  it  violates  the  domestic  law  of  virtually  all  states.  The  U.S. 
Government  would  need  to  consider  the  diplomatic,  political,  and  precedential 
ramifications  that  would  arise  if  such  an  investigation  were  detected,  just  as  it  would  have 
to  in  the  case  of  more  traditional  forms  of  espionage  or  covert  action. 

Responding 

Extradition 

Obviously,  a  government  cannot  respond  to  an  attack  successfully  unless  it  can  identify 
the  attack's  source.  If  the  culprits  can  be  identified,  the  options  available  for  the  victim 
state  are  unsettled  and  potentially  unsatisfactory.  As  discussed  above,  it  may  be  difficult, 
if  not  impossible,  to  tie  the  individual  culprits  to  state  support.  A  victim  state  may 
therefore  need  to  proceed  as  if  a  given  attack  were  a  purely  criminal  matter,  and  request 
that  the  state  in  which  the  culprits  are  present  extradite  them  to  its  territory  for  trial.  Even 
where  the  victim  has  substantial  grounds  for  believing  that  state  support  existed,  it  may 
proceed  with  the  extradition  request,  because  denial  of  the  request  may  be  seen  in  world 
forums,  as  well  as  in  its  domestic  politics,  as  further  evidence  of  that  state's  complicity. 
The  UN  sanctions  against  Eibya  in  the  wake  of  the  Eockerbie  bombing,  for  example, 
stemmed  not  as  directly  from  Eibya's  involvement  in  the  bombing,  as  they  did  from 
Eibya's  refusal  to  extradite  the  alleged  bombers  to  the  United  States  or  United  Kingdom, 
in  violation  of  Security  Council  Resolution  748.  The  significance  of  political 
considerations  in  such  a  calculus  is  emphasized  by  the  fact  that  at  the  time  the  sanctions 
were  promulgated,  Eibya,  which  had  claimed  to  be  willing  to  try  the  alleged  culprits,  had 
not  actually  violated  the  procedural  terms  of  the  Montreal  Convention  on  the  Suppression 
of  Unlawful  Acts  Against  Civil  Aviation,  which  permits  a  signatory  to  extradite  or  try  a 
suspect  (although,  of  course,  bombing  a  plane  would,  indeed,  violate  the  convention).'’^ 

The  ability  of  a  victim  state  to  gain  custody  of  those  who  have  attacked  its  systems  from 
abroad  is  complicated  by  the  collision  of  the  longstanding  international  state  system,  the 
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international  nature  of  networks,  and  the  relative  historical  novelty  of  computers  and 
networks.  For  a  country  to  apprehend  an  alleged  criminal  in  a  foreign  country  and 
transport  the  culprit  to  the  requesting  country  for  trial,  certain  conditions  must  exist.  First, 
an  extradition  treaty  must  bind  both  countries,  as  there  is  no  underlying  right  of 
extradition  under  international  law.  Extradition  treaties  may  be  bilateral  or  multilateral, 
and  they  may  apply  to  a  broad  range  or  to  discrete  categories  of  offenses. 

Second,  the  requesting  country  must  have  jurisdiction  to  prescribe  the  activity  for  which 
it  seeks  extradition;  in  other  words,  it  must  be  within  the  power  of  the  state  to  apply  its 
laws  to  the  relevant  conduct.  States  base  their  claims  to  jurisdiction  over  criminal 
suspects  on  five  general  theories:  first,  and  most  simply,  the  territorial  theory,  by  which 
states  claim  jurisdiction  over  those  who  act  within  their  territories;  second,  nationality,  by 
which  states  claim  jurisdiction  over  their  nationals;  third,  protective,  by  which  states 
claim  jurisdiction  over  those  whose  activities  threaten  their  security  or  vital  interests; 
fourth,  passive  personality,  by  which  they  claim  jurisdiction  over  those  who  might 
threaten  their  nationals,  even  if  they  are  abroad;  and  fifth,  universality,  under  which  all 
states  may  claim  jurisdiction  over  those  who  have  committed  certain  universally 
condemned  crimes,  such  as  piracy.  An  extended  discussion  of  prescriptive  jurisdiction 
is  beyond  the  scope  of  this  report,  but  it  seems  obvious  that  an  attack  against  U.S. 
systems  would  fall  within  U.S.  prescriptive  jurisdiction,  even  if  its  perpetrators  were 
beyond  the  reach  of  U.S.  authorities.’^^ 

Third,  virtually  all  extradition  treaties  contain  a  "double  criminality"  requirement  that 
mandates  that  the  act  that  is  the  basis  for  the  extradition  request  be  an  offense  under  the 
laws  of  both  the  requesting  country  and  the  one  to  which  the  request  is  directed. This 
requirement  has  been  a  significant  obstacle  to  U.S.  efforts  to  try  those  who  have  intruded 
into  sensitive  U.S.  data  systems.  In  the  case  of  computer  hackers  from  the  Netherlands 
who  broke  into  U.S.  Navy  and  NASA  systems  during  the  Persian  Gulf  War,  for  example, 
Dutch  concepts  of  privacy  were  such  that  the  hackers'  intrusion  into  sensitive  systems 
was  not  yet  considered  a  crime  under  Dutch  law.’’^  Similarly,  when  Julio  Caesar  Ardita, 
a  young  Argentine,  broke  into  computers  containing  sensitive  information  at  the  Naval 
Command  Control  and  Ocean  Surveillance  Center,  the  Navy  Research  Laboratory,  and 
Los  Alamos  National  Laboratory,  among  others,  the  United  States  was  unable  to  obtain 
his  extradition,  even  though  Argentine  police  cooperated  with  U.S.  authorities,  because 
Argentina's  legal  system,  faced  with  new  technology,  had  not  yet  classified  such 
intrusions  as  criminal.’^’’ 

The  dual  criminality  requirement  has,  perhaps,  also  protected  U.S.  nationals  who  have 

been  combatants  in  a  different  form  of  information  conflict,  namely  the  conflict 

surrounding  the  spread  of  U.S.  popular  culture.  Lor  example,  when  a  Pakistani  cleric 

recently  reportedly  asked  the  U.S.  Department  of  State  to  extradite  the  entertainers 

Madonna  and  Michael  Jackson  because  the  lasciviousness  of  their  performances  violated 

Islamic  law,  the  United  States  had  no  obligation  to  comply  because,  among  other  reasons, 
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such  violations  of  Islamic  law  are  not  criminal  offenses  in  the  United  States. 

Lastly,  most  extradition  treaties  contain  exemptions  for  "political  offenses,"  although 
governments  interpret  that  term  differently.  Some  states  will  refuse  extradition  only 
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where  the  erime  for  which  extradition  is  sought  is  a  "pure"  political  offense,  one  directed 
at  a  sovereign  political  institution,  absent  the  elements  of  common  crime.  Others  refuse 
extradition  for  offenses  committed  in  connection  with  a  political  cause  or  national 
liberation  struggle.  Some  other  states  require  that  the  political  elements  of  the  offense 
predominate  over  the  common  criminal  elements.  Finally,  the  French  interpretation  of  the 
political  offense  exception  is  broader;  French  courts  tend  to  deny  extradition  when  a  state 
wishes  to  punish  an  offender  for  injuries  inflicted  upon  that  state.  Whatever 
interpretation  they  embrace  formally,  many  states  will  find  rationales  to  deny  extradition 
for  those  accused  offenders  whom  they  do  not  wish  to  extradite. 

A  country's  extradition  requests  for  those  who  have  attacked  it  from  abroad  may  fail  for 
several  reasons  distinct  from  the  aforementioned  requirements.  First,  a  country  that 
supported  an  attack  will  have  tremendous,  obvious  incentives  not  to  extradite  its  agents 
and  may  take  advantage  of  any  loophole  it  can  find.  Such  loopholes  may  include  the 
requirements  discussed  above,  as  well  as  the  prohibition  in  many  countries'  domestic 
laws  against  extradition  of  their  own  nationals.  For  example,  in  rejecting  the  U.S.  and  UK 
requests  that  it  extradite  the  agents  who  were  alleged  to  have  carried  out  the  Lockerbie 
bombing,  Libya  claimed  that  its  law  prohibited  the  extradition  of  its  nationals  and  said 
that  it  planned  to  try  them  itself,  fulfilling  its  obligations  under  the  Montreal 
Convention. 

Second,  as  has  apparently  been  the  case  with  some  terrorists,  governments  may  reject 
extradition  requests  out  of  fear  that  the  alleged  criminals'  colleagues  will  retaliate  against 
them  for  their  cooperation.  In  1977,  for  example,  France  released  Abu  Daoud,  the 
architect  of  the  1972  Munich  Olympic  massacre,  despite  efforts  of  the  Federal  Republic 
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of  Germany  and  Israel  to  obtain  his  extradition,  apparently  because  it  feared  retaliation. 
Similarly,  after  two  Germans  were  taken  hostage  in  Beirut,  West  Germany  used  the 
political  offense  exception  in  its  extradition  treaty  with  the  United  States  and  released 
Mohammed  Ah  Hamadei,  whom  the  United  States  had  indicted  for  hijacking  TWA  flight 
847  in  1987.  Where  information  attacks  with  broad  effects  may  be  carried  out  from  a 
distant  sanctuary,  the  threat  of  such  retaliation  would  appear  particularly  grave,  especially 
for  Western  or  other  developed  nations  with  significant  dependence  upon  information 
infrastructures. 

Third,  the  United  States  and  other  countries  with  advanced,  vulnerable  information 
infrastructures  may  exert  diplomatic  or  other  pressure  to  close  some  of  the  above 
loopholes,  especially  the  failure  of  many  countries'  legal  codes  to  recognize  certain  forms 
of  computer  intrusions  as  crimes.  Nevertheless,  potential  incentives  exist  for  countries  to 
refuse  to  join  any  such  formal  or  informal  regime.  First,  of  course,  some  countries  may 
wish  to  use  such  intrusions  or  other  attacks  for  their  own  political,  economic,  or  other 
ends,  and  they  may  value  maintaining  that  offensive  capacity  more  than  they  do  the 
incremental  security  that  their  systems  would  receive,  particularly  where  their  systems 
are  poorly  developed  or  relatively  unimportant.  Secondly,  it  is  conceivable,  although 
perhaps  unlikely,  that  some  nations  may  have  ideological  reasons  to  resist  such  rules, 
such  as  differing  conceptions  of  privacy  in  electronic  systems  or  data,  or  distrust  of  any 
system  that  would  appear  to  preserve  the  advantages  of  the  developed  nations.  Finally, 
and  perhaps  most  disturbingly,  countries  may  choose  not  to  criminalize  certain  conduct 
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as  part  of  a  development  strategy.  In  what  eould  be  termed  a  form  of  "regulatory 
arbitrage,"'^’  nations  that  hope  to  improve  their  information  teehnology  development 
may  permit  the  behavior  of  haekers  or  other  attaekers  in  the  hope  that  they  will  reloeate 
to  these  nations,  bringing  with  them  their  teehnieal  expertise.  Sueh  eountries  may  seek 
the  skilled  personnel  either  to  deploy  them  against  enemies  or  to  build  their  own 
eeonomy  or  infrastrueture. 

Although  the  eoneept  of  "regulatory  arbitrage"  may  seem  farfetehed,  it  should  not  be 
dismissed  out  of  hand.  First,  it  seems  likely  that  eountries,  as  well  as  transnational 
eriminal  organizations  and,  perhaps,  terrorist  groups,  have  sought  individuals  or  groups 
of  foreign  haekers  to  engage  in  espionage,  erime,  or  other  attaeks  and  that  sueh 
reeruitment  will  oeeur  in  the  future.  During  the  1980s,  for  example,  the  Soviet  Union 
employed  a  group  of  West  German  eomputer  haekers,  who  were  eventually  apprehended 
after  they  broke  into  a  series  of  U.S.  eivilian  and  military  eomputers  in  seareh  of  U.S.  and 
NATO  defense  seerets.  Seeond,  "regulatory  arbitrage"  has  taken  plaee  in  other 
eontexts.  For  example,  in  the  wake  of  the  U.S.  military  and  diplomatie  withdrawal  after 
the  Cold  War,  the  Seyehelles,  hoping  to  attraet  foreign  eapital,  enaeted  an  Eeonomie 
Development  Aet  that  granted  eitizenship  and  immunity  from  asset  forfeiture  or 
extradition  to  anyone  investing  at  least  $10  million  in  the  islands. Closer  to  home,  the 
legislatures  of  several  U.S.  states  have,  at  times,  engaged  in  a  "raee  to  the  bottom," 
weakening  their  restrietions  on  the  eonduet  of  eorporate  offieers  and  direetors  in  the  hope 
of  attraeting  eorporations  to  register  in  their  respeetive  states. States  and  eountries  have 
also  given  speeial  ineentives,  redueing  taxes  and  regulations  or  providing  other  benefits, 
in  the  hope  of  attraeting  business,  ineluding  professional  sports  franehises. 

Where  a  government  refuses  to  extradite  those  responsible  for  attaeks  against  another 
eountry,  the  vietim  state  is  not  without  reeourse,  although  some  options  faeing  it  may  not 
be  partieularly  attraetive.  First,  of  eourse,  it  may  exert  diplomatie,  eeonomie,  or 
multilateral  pressure  against  an  uneooperative  state,  as  has  been  the  unsueeessful  ease 
with  Libya  after  the  Loekerbie  bombing.  Seeond,  it  may  attempt  to  eapture  the  alleged 
eulprits  and  bring  them  baek  home  for  trial. 

A  government  may  eontemplate  abduetions  of  eriminal  suspeets  from  foreign  lands  when 
the  urgent  need  to  try  the  suspeets  outweighs  the  diplomatie  and  preeedential  eosts  of  the 
abduetion,  and  where  sueh  abduetions  do  not  violate  the  government's  domestie  law  (if 
the  government  eares  about  sueh  nieeties).  Abduetion  of  suspeets  from  foreign  lands  is 
not  illegal  under  U.S.  law,  nor,  at  least,  does  it  deprive  U.S.  eourts  of  their  ability  to  try 
abduetees.  In  1990,  for  example,  after  the  Mexiean  government  was  unwilling  or  unable 
to  extradite  Dr.  Humberto  Alvarez-Maehain,  who  had  been  indieted  in  a  U.S.  eourt  for 
his  role  in  the  torture  and  murder  of  Enrique  Camarena-Salazar,  a  U.S.  Drug  Enforeement 
Administration  agent,  U.S.  agents  abdueted  Dr.  Alvarez-Maehain  and  returned  him  to  the 
United  States  for  trial.  The  U.S.  Supreme  Court  ultimately  held  that  neither  general 
prineiples  of  international  law  nor  the  terms  of  the  U.S.-Mexieo  extradition  treaty  barred 
his  proseeution,  and  that  foreible  abduetion  does  not  deprive  a  eourt  of  the  ability  to 
eonsider  the  ease  against  the  suspeet.^^'  Eventually,  though,  eharges  against  Alvarez- 
Maehain  were  dismissed  for  laek  of  evidenee. 
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Depending  upon  the  language  of  the  applieable  extradition  treaty,  sueh  abduetion  will  not 
violate  its  terms  and,  under  the  maxim  male  eaptus,  bene  detentus,  international  law 
reeognizes  the  right  of  a  state  to  try  a  suspeet,  even  where  his  eapture  was  teehnieally 
illegal.  Nevertheless,  agents  operating  abroad  to  eapture  suspeets  do  violate  the 
sovereignty  of  the  eountries  in  whieh  they  operate  and  risk  punishment,  perhaps  for 
espionage  or  kidnapping,  if  they  are  apprehended  by  those  eountries'  authorities. 
Furthermore,  in  the  wake  of  the  international  and  domestie  furor  that  followed  the 
abduetion  of  Alvarez -Maehain  and  the  Supreme  Court  opinion  permitting  the  abduetion, 
sueh  abduetions  seem  likely  to  be  extremely  rare. 

Retaliation 

Responding  to  an  "armed  attack."  Where  a  state  ean  tie  an  attaek  to  a  foreign 
government,  it  may  need  to  retaliate,  either  to  terminate  an  ongoing  attaek  or  to  prevent 
future  attaeks.  The  retaliating  state  would  probably  justify  its  retaliation  as  part  of  its 
right  of  self-defense  as  set  out  in  Artiele  5 1  of  the  UN  Charter.  However,  it  is  not  obvious 
that  Artiele  51  aetually  provides  a  basis  for  military  aetion  against  a  state  eondueting 
eertain  information  attaeks. 

As  diseussed  above,  the  peaeeful  settlement  of  disputes  is  one  of  the  primary  purposes  of 
the  United  Nations  Charter. The  Charter  forbids  the  threat  or  use  of  foree  by  one  state 
against  the  territorial  integrity  or  politieal  independenee  of  another  state. The  only 
lawful  use  of  foree,  besides  eolleetive  aetion  to  enforee  peaee  under  UN  auspiees,  is  in 
individual  or  eolleetive  self-defense  against  "armed  attaek."  As  the  International  Court 
of  Justiee  asserted  in  its  opinion  in  the  ease  of  Niearagua  v.  United  States,  states  do  not 
have  a  right  of  armed  response  to  aets  whieh  do  not  eonstitute  an  "armed  attaek." A 
eomputer  network-based  attaek,  or  one  involving  software  weapons  sueh  as  viruses, 
would  not  unquestionably  qualify  as  "armed  attaek"  under  the  UN  Charter,  and  thus 
might  not  provide  the  international  legal  basis  for  a  eonventional,  kinetie  military 
response. 

The  UN  Charter  does  not  define  "armed  attaek";  nor  has  the  International  Court  of  Justiee 

(ICJ)  laid  out  any  eomprehensive  definition.  To  the  extent  that  the  term  has  been 

eonstrued,  it  seems  to  inelude  the  use  of  armed  forees,  foree,  or  violenee,  as  well  as 

interferenee  with  a  nation's  sovereign  rights.  Eeonomie  eoereion  does  not  eonstitute 

"armed  attaek"  nor,  for  that  matter,  aeeording  to  the  ICJ,  did  the  Niearaguan  Sandinista 

government's  aetions  in  providing  sanetuary  and  support  during  the  early  1980s  to  the 

rebels  who  fought  the  U.S.-baeked  government  of  El  Salvador.^^^  Even  aetions  using 

destruetive  physieal  foree  may  not  rise  to  the  level  of  "armed  attaek."  Despite  repeated 

requests,  the  United  Nations  refused  to  reeognize  guerrilla  and  terrorist  attaeks  by 

Palestinians  against  Israel  during  the  late  1960s  and  early  1970s  as  armed  attaeks, 

rejeeting  the  Israeli  position  that  individual  small  attaeks  from  bases  in  Eebanon  should 

be  eonsidered  on  a  eumulative  basis,  as  parts  of  an  "armed  attaek"  justifying  Israeli 
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ineursions  into  Lebanon. 

As  diseussion  of  sueh  terms  as  "war,"  "aggression,"  and  "foree"  have  shown,  it  ean  be 
diffieult  to  prediet  whether  speeifie  aetions  will  be  eonsidered  to  be  "armed  attaeks." 
Unlike  the  domestie  eriminal  law,  international  law  sets  out  no  mandatory  elements  of 
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"crimes,"  and  any  determination  in  sueh  forums  as  the  United  Nations  will  be  inherently 
politieal  and  diplomatic. Nevertheless,  it  appears  likely  that  an  "armed  attaek"  would 
include  some  level  of  aetual  or  potential  physieal  destruction,  combined  with  some  level 
of  intrusion  into  its  target's  borders,  or  violation  of  its  sovereign  rights.  Figure  4  is  a 
rough  attempt  to  predict  potential  eategorization  of  information  warfare  attacks. 

FIGURE  4 


FIGURE  4.  CLASSIFICATION  OF  ATTACKS 


Some  attacks,  such  as  aerial  bombing  strikes  against  a  nation's  military  command  and 
control  centers,  are  highly  likely  to  be  considered  "armed  attacks,"  as  they  involve  high 
levels  of  both  intrusion  and  destruction.  Other  attaeks,  such  as  propaganda  broadcasts,  are 
unlikely  to  be  considered  "armed  attacks,"  at  least  by  relatively  impartial  world  forums. 
Attaeks  sueh  as  computer  intrusions  or  communieations  disruptions  are  mueh  harder  to 
eharaeterize.  It  may  be  that  increases  in  one  variable  may  make  up  for  limitations  in  the 
other.  For  example,  computer  intrusions  for  purposes  of  stealing  data  and  to  disrupt  air 
traffie  control  may  be  equally  intrusive,  but  the  greater  level  of  destruction  and  death  that 
the  air  traffie  eontrol  system  attaek  may  cause  may  make  it  more  likely  to  be  considered 
"armed  attack"  than  would  the  data  theft  attempt.  Furthermore,  attacks  that  are 
sufficiently  destruetive  may  qualify  as  "armed  attacks,"  no  matter  what  their  level  of 
intrusion,  and  vice  versa. 

If  a  target  eountry  cannot  characterize  a  computer  attaek  against  its  information  systems 
as  an  "armed  attack,"  then  it  may  not  be  able  to  respond  to  the  attack  with  conventional, 
kinetie  force,  unless  it  wants  to  risk  having  its  response  considered  the  aggressive  "armed 
attaek"  under  Artiele  51.  Presumably,  a  response  in  kind  would  not  eonstitute  "armed 
attaek"  if  the  original  attaek  did  not,  but  some  potential  information  attackers,  who  may 
be  able  to  hire  from  abroad  the  equipment  and  expertise  they  need  for  their  attaeks,  may 
laek  the  information  infrastructures  to  make  them  vulnerable  to  such  attacks. 

Proportionality.  In  addition  to  the  United  Nations'  requirements  that  force  be  limited  to  a 
response  to  an  armed  attack,  customary  international  law  has  developed  requirements  for 
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retaliation.  Such  retaliation  must  be  in  individual  or  collective  self-defense  against  an 
attack;  it  must  be  necessary  to  stop  the  initial,  unjustified  attack  or  to  prevent  further 
violations;  and  it  must  be  proportional  to  the  attack  to  which  it  is  a  response. 

The  proportionality  analysis  applies  in  two  ways.  First,  under  the  requirements  of  the  jus 

ad  helium,  the  level  of  force  of  the  response  must  be  proportionate  to  that  of  the  initial 

attack-a  full-scale  blitzkrieg  across  a  broad  front  accompanied  by  aerial  bombing  would 

generally  be  disproportionate  to  a  patrol's  border  raid,  for  example.  Second,  as  in  any 

other  military  action,  the  response  must  balance  the  damage  it  will  inflict,  especially  to 
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civilians,  against  the  military  objectives  it  is  intended  to  accomplish. 

Just  as  it  is  not  obvious  that  an  information  attack  will  be  an  "armed  attack,"  it  is  not 
obvious  what  would  be  proportionate  to  such  an  attack,  especially  where  the  attack 
inflicts  little  or  no  physical  destruction  or  loss  of  life.  Where  a  computer  intrusion 
disrupts  or  corrupts  a  database  or  denies  service  for  important  elements  of  the  electronic 
infrastructure,  inflicting  great  hardship  on  the  target  country,  that  country  must  determine 
what  sort  of  response  would  be  proportionate  to  the  attack.  In  the  absence  of  real  physical 
destruction  or  death,  such  as  by  the  crash  of  a  passenger  aircraft  through  manipulation  of 
the  air  traffic  control  system,  it  is  questionable  that  a  conventional  military  attack  would 
be  proportionate.  The  use  of  force  may  be  qualitatively  distinct  from  other  tools  of 

coercion,  as  demonstrated  by  its  inclusion  in  the  UN  Charter  and  the  UN  definition  of 
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aggression. 

If  a  conventional  response  is  disproportionate  to  an  information  warfare  attack,  a 
response  in  kind  could  seem  likely  to  be  proportionate.  However,  such  a  response  may 
require  the  use  of  neutral  assets,  such  as  networks  owned  by  or  passing  through  neutral 
countries  and  thus  could  run  the  risk  of  violating  their  neutrality.^  ^  Perhaps  more 
significantly,  because  of  the  limited  infrastructure  and  resources  necessary  to  conduct 
some  information  warfare  attacks,  and  the  potential  expertise  available  for  hire  or 
ideological  recruitment,  an  adversary  who  has  attacked  the  United  States  or  a  similarly 
advanced  country  may  lack  sufficient  targets  for  an  information  warfare  response,  or  may 
have  only  targets  that  are  too  important  to  be  retaliated  against  for  anything  other  than  a 
grave  attack.  It  would  seem  inappropriate  to  cause  aircraft  to  crash,  for  example,  in 
retaliation  for  a  limited  disruption  of  a  local  telephone  network,  or  an  intrusion  into  a 
military  computer. 

It  seems  unlikely  that  the  United  States  would  refrain  from  traditional  military  retaliation 
where  an  information  warfare  response  would  be  inappropriate  overkill  or  ineffectual 
underkill.  It  also  seems  unlikely  that  international  law  would  mandate  such  inaction. 
Assuming  that  an  information  warfare  attack  is  an  "armed  attack,"  and  an  information 
warfare  response  were  unavailable  or  excessive,  then  a  kinetic  response,  appropriately 
calibrated,  would  seem  proportional  even  if,  as  a  general  rule,  the  relevant  form  of 
information  warfare  attacks  were  considered  distinct  from  violence. If  the  information 
warfare  attack  is  not  an  "armed  attack"  justifying  a  military  response  under  the  UN 
Charter,  then,  aside  from  such  measures  as  economic  sanctions,  the  United  States  might 
then  assert  an  underlying,  inherent  right  of  national  self-defense,  which  predates  and  goes 
beyond  the  rights  contained  in  Article  51  of  the  UN  Charter,^®^  rather  than  suffering 
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ongoing  attacks  stoically  or  petitioning  the  UN  Security  Council  for  help.  In  considering 
their  responses  to  such  attacks,  policymakers  must  be  aware  that  their  aetions  may 
establish  precedents  that  other  nations  may  look  to  in  similar  eireumstances,  or  draw 
upon  eynically  to  excuse  their  behavior  in  dissimilar  eireumstances. 

In  sum,  eurrent  understandings  of  "armed  attaek,"  as  well  as  dissonance  between 
international  networks  and  the  international  system  of  state  sovereignty,  may  eomplicate 
or  hinder  victims'  efforts  to  respond  to  information  warfare  attacks.  The  United  States 
may  need  to  pursue  international  initiatives  to  change  that  understanding,  as  well  as  to 
alter  nations'  responsibilities,  or  lack  thereof,  to  forego  such  attacks,  prevent  their 
oecurrence,  or  to  cooperate  in  defensive  or  law  enforeement  measures. 
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Chapter  4:  Conclusion — Reconciling  Technology  and 
International  Law,  Resolving  Ambiguities,  and  Balancing 

Capabilities 

As  discussed  above,  international  law  has  not  yet  resolved  ambiguities  over  the 
eharacterization  of  information  warfare  aetivities,  and  must  faee  a  eonfliet  between  the 
international  system  of  sovereign  states  and  the  realities  of  global  networks.  International 
law  thus  leaves  spaee  for  the  United  States  and  others  to  eonduet  information  warfare 
aetivities,  perhaps  even  in  peacetime,  without  significant  legal  repercussions.  Conversely, 
international  law  may  permit  attaeks  against  the  United  States,  as  well  as  exaeerbate  U.S. 
diffieulties  in  responding  to  attaeks  against  it,  partieularly  in  peaeetime. 

The  legal  status  quo  may  appear  satisfactory  to  U.S.  policymakers.  As  the  United  States 
apparently  leads  the  world  in  information  warfare  development,  an  international  legal 
regime  that  permits  information  attaeks  ean  give  it  an  advantage,  allowing  the  United 
States  to  apply  its  teehnologieal  strength  to  international  oonfliets  in  ways  beyond  the 
eapaeities  of  anyone  else.  In  the  absenee  of  eonelusive  legal  authority  indieating,  say,  that 
particular  information  warfare  attaeks  are  "armed  attacks,"  "aggression,"  or  "foree,"  the 
United  States  ean  aet  with  some  eonfidenee  that  its  acts  will  not  be  held  to  be  so.  Given 
its  position  in  the  world,  the  United  States  will  have  the  opportunity  to  begin  the  state 
praetiee  that  can  establish  international  norms  and,  perhaps,  customary  international  law. 
To  an  extent,  then,  given  the  United  States'  voiee  in  world  polities  and  predominant 
military  might,  the  United  States  is  in  the  positions  of  legislator,  sheriff,  and  (perhaps,  to 
its  adversaries)  exeeutioner,  and  it  has  a  lot  of  influenee  over  the  judge. 

Despite  its  freedom  to  act,  the  United  States  should  not  be  sanguine  about  the  state  of 
international  law.  The  "legislator,  sheriff,  and  executioner"  may  all  live  together  in  a 
large  glass  house.  Just  as  the  United  States  ean  attaek,  it  ean  be  attaeked,  and  its  aetions 
in  condueting  attaeks  may  provide  preeedent  for  attaeks  against  it  and  its  allies. 
Furthermore,  just  as  U.S.  capabilities  may  outstrip  those  of  its  potential  adversaries,  so 
too  may  its  vulnerabilities,  as  it  is  perhaps  uniquely  dependent  upon  its  information 
infrastrueture  for  both  eivilian  and  military  needs.  If  only  to  inerease  proteetion  for  U.S. 
systems,  then,  eertain  nonexelusive  legal,  diplomatie,  or  policy  initiatives  may  be 
appropriate. 

Resolution  of  Legal  Ambiguities 

A  first  approaeh  would  be  to  elarify  the  delineation  of  sueh  terms  as  "armed  attaek," 
"foree,"  and  others,  so  that  the  status  of  information  warfare  attaeks  under  international 
law  is  understood.  Without  knowing  the  extent  of  U.S.  offensive  eapabilities  or  defensive 
vulnerabilities,  it  is  impossible  for  us  to  judge  the  desirability  of  limiting  information 
warfare.  The  United  States  might  support  restrietive  definitions  of  those  terms,  so  as  to 
preserve  its  ability  to  use  its  teehnologieal  advantages,  to  proteet  potentially  desirable 
teehnologieal  developments,  and  to  encourage  the  use  of  nonlethal  methods  of  oonfiiet; 
or  it  might  support  broad  definitions,  to  help  reduee  the  lawful  methods  by  whieh 
adversaries  ean  exploit  its  vulnerabilities.  Definitions  that  ineluded  nonlethal  information 
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warfare  attacks  within  "war"  or  "force"  could  give  civilians  a  measure  of  protection  from 
such  attacks  during  times  of  peace,  as  they  would  increase  the  diplomatic  and  political 
repercussions  of  such  attacks.  To  protect  civilian  targets  during  wartime,  the  United 
States  could  pursue  treaties  or  other  international  understandings  that  the  financial  or 
other  intangible  damages  caused  by  certain  types  of  nonlethal  information  attacks  are, 
indeed,  the  types  of  injuries  against  which  humanitarian  law  should  protect 
noncombatants. 

The  United  States  may  use  several  legal  mechanisms  to  achieve  the  goal  it  chooses, 
ranging  from  a  treaty  setting  out  the  circumstances  in  which  certain  types  of  information 
warfare  are  permissible,  to  silence  on  the  subject  to  avoid  hindrances  on  U.S.  capabilities. 
Additionally,  the  United  States  could  try  to  influence  the  development  of  customary 
international  law  regarding  the  appropriateness  of  information  warfare.  It  may  move  for 
declarations  of  the  UN  General  Assembly  interpreting  the  Charter  as  it  would  apply  to 
information  warfare.  U.S.  statements  of  its  views  on  the  subject  would  have  a 
significant  effect  both  on  the  opinions  of  other  states  and,  ultimately,  the  emergence  of 
international  norms  regarding  information  attacks,  or  particular  aspects  thereof.  Although 
customary  international  law  traditionally  evolved  naturally  from  state  practice  over  an 
extended  period  of  time,  states  have  recently  pursued  efforts  to  create  customary  law 
purposefully.  Such  efforts  have  been  most  visible  in  international  forums,  such  as  the 
General  Assembly,  which  has  passed  declarations  setting  out  world  opinion  as  to  the  state 
of  the  law  on  such  topics  as  the  use  of  nuclear  weapons,  seabed  mining,  or  the  equation 
of  Zionism  with  racism. 

There  is  no  reason,  though,  that  an  individual  state  could  not  set  out  to  influence  the 
development  of  customary  legal  norms,  especially  in  an  area  such  as  information  warfare, 
where  that  state  leads  the  world  in  the  development  or  application  of  the  technologies  and 
techniques  to  which  these  norms  would  be  applied.  U.S.  efforts  to  draw  world  attention  to 
dangers  that  information  warfare  poses  could  be  counterproductive,  however,  as  they 
might  spur  other  countries'  efforts  to  obtain  or  use  information  warfare  weapons,  and 
those  countries  may  be  suspicious  of  what  they  perceive  to  be  U.S.  efforts  to  protect  its 
technological  advantages  or  retard  the  development  of  others'  capacities. 

International  Cooperation  Against  Computer  Attacks 

Second,  to  improve  its  defensive  or  responsive  options,  the  United  States  could  make 
efforts  to  reconcile  the  system  of  sovereign  states  with  international  networks,  through 
promoting  harmonization  of  laws  and  cooperation  in  investigation  and  prosecution  of 
computer  attacks.  The  first  part  of  such  a  strategy  would  include  diplomatic  pressure  and 
criminal  justice  advice  and  assistance  to  promote  the  criminalization  of  computer-based 
attacks  in  those  nations  that  do  not  yet  recognize  such  attacks  as  crimes,  both  to 
encourage  other  countries  to  discourage  such  behavior  by  individuals  within  their 
borders,  and  to  enable  extradition  of  offenders.  Secondly,  the  United  States  could  support 
the  development  of  an  extradition  regime  for  criminal  or  terrorist  computer  attacks, 
obliging  all  countries  to  extradite  or  try  those  who  have  committed  specified  network- 
related  crimes.  Models  for  such  measures  could  be  drawn  from  the  treaties  executed  in 
the  1960s  and  early  1970s  to  combat  hijacking  and  other  terrorism  against  civil 
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aviation.^'*^  The  Montreal  Convention  on  the  Suppression  of  Unlawful  Acts  Against  Civil 
Aviation,  for  example  makes  it  an  offense  for  anyone  to  destroy  an  aircraft,  place  a 
device  likely  to  destroy  an  aircraft,  destroy  or  damage  air  navigation  facilities,  or 
communicate  information  which  he  knows  to  be  false,  thus  endangering  the  safety  of 
aircraft  in  flight,  and  it  obliges  countries  to  extradite  or  try  suspected  offenders.  Such 
agreements,  along  with  diplomatic  and  other  public  statements  relating  to  the 
criminalization  of  such  attacks,  could  also  contribute  to  the  development  of  a  norm  that 
countries  cannot  support  computer-based  attacks  in  peacetime,  or  that  they  must 
cooperate  in  resisting  such  attacks.  Given  the  United  States'  and  its  allies'  ambiguous 
success  in  fighting  international  terrorism,  it  is  obvious,  though,  that  such  agreements  or 
norms  would  not  be  panaceas. 

Protection  of  Critical  Systems 

Third,  just  as  the  aviation  efforts  were  incremental  steps  in  the  fight  against  terrorism, 
similar  efforts  could  be  made  for  the  protection  of  particular  information  systems  from 
dangers  including  crime,  terrorism,  war,  or  even  natural  disasters.  Some  systems  may  be 
so  critical  that  countries  can  agree  that  they  must  be  put  off  limits  from  attacks,  or  that  all 
countries  must  cooperate  to  defend  them.  Systems  that  could  be  the  subject  of  individual 
protection  regimes  include  those  involved  in  the  command  and  control  of  strategic 
weapons,  international  financial  transfers,  individual  financial  markets  or  stock 
exchanges,  telephone  switches,  emergency  communications,  rail  transport,  and  medical 
databases.  Such  arrangements  could  be  pursued  under  direct  UN  auspices,  or  as 
individual  treaties  in  the  context  of  existing  institutions,  such  as  the  ITU,  OECD,  or 
ICAO,  or  even,  perhaps  the  World  Intellectual  Property  Organization  (WIPO). 

Along  with  providing  legal  bases  for  responses  and  countermeasures,  incremental 
prohibitions  against  certain  information  warfare  attacks  could  contribute  to  the 
development  of  broader  international  norms  against  such  attacks,  particularly  in 
peacetime.  In  the  context  of  nuclear  weapons,  in  comparison,  proclamations  and  regional 
agreements  against  the  use  of  nuclear  weapons  contributed  to  the  legal  argument  that  the 

use  of  such  weapons  had  become  illegal,  although  the  International  Court  of  Justice  did 
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not  ultimately  embrace  that  argument. 

Arms  Control  for  Information  Warfare? 

A  fourth  approach  that  has  been  suggested  could  be  to  pursue  some  sort  of  ban  on 
information  warfare  attacks  or  control  of  the  weapons  of  information  warfare.  Such  an 
approach  would  seem  to  provide  clear  legal  norms  to  guide  future  actions,  and  might 
seem  particularly  sensible  if  the  United  States  were  to  determine  that  its  vulnerabilities 
outweighed  its  technological  advantages. 

But  such  clarity  would  be  illusory;  the  distinction  between  information  warfare  and 
traditional  warfare  is  blurry,  at  best.  An  information  warfare  weapons  ban  would  pose 
problems  because  not  only  do  many  information  weapons  have  dual  military  and  civilian 
uses,  but  their  applications  are  predominantly  civilian.  Because  of  technological 
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diffusion,  the  small  size  of  much  information  technology,  and  its  primary  incorporation 
into  consumer  goods,  an  arms  control  regime  would  seem  difficult  to  enforce. 
Furthermore,  although  arms  controls  and  weapons  bans  have  been  applied  to  new 
technologies  before  they  were  widely  used  or  their  military  ramifications  understood,  as 
in  the  bans  on  bacteriological  weapons,^'"^  hostile  use  of  environmental  modification 
techniques,^'^  and  blinding  laser  weapons,^^^  it  does  seem  premature  to  limit  a  weapon 
that  promises  to  bring  some  measure  of  nonlethality  to  conflict,  and  in  which  the  United 
States  apparently  holds  an  advantage  in  development.  In  any  event,  arms  controls  or 
warfare  bans  would  not  apply  to  the  non-state  actors,  such  as  terrorists  or  criminal 
organizations,  who  would  not  be  parties  to  the  agreements  and  who  may  make  up  the 
gravest  short-term  information  warfare  threat.  Such  bans,  then,  would  not  eliminate  the 
need  for  defensive  measures,  so  countries  might  still  need  to  explore  offensive 
capabilities,  if  only  to  test  their  defensive  measures  adequately. 

The  Lure  of  Inactivity 

A  final  prospective  course  of  action  is  to  do  nothing,  or  very  little.  Although  international 
law  does  not  now  conclusively  address  the  legality  of  many  information  warfare  attacks 
or  the  appropriate  responses  to  them,  that  has  not  been  a  grave  problem  yet,  because  the 
attacks,  aside  from  some  computer  intrusions  and  crimes,  have  not  been  particularly 
serious.  But  as  information  technology  continues  to  develop  and  diffuse,  the  danger  of 
such  attacks  seems  likely  only  to  increase,  as  might  the  opportunities  for  U.S.  offensive 
uses.  If  the  United  States  needs  to  conduct  such  attacks,  it  will  undoubtedly  do  so.  If  the 
United  States  is  subject  to  attacks,  it  will  respond.  International  law  will  address 
information  warfare  attacks  in  some  way  or  another.  It  may  be  wise  to  address  the  legal 
issues  that  the  United  States  will  face  in  advance,  rather  than  having  to  address  them  in 
the  heat  of  an  emergency,  where  inadequate  legal  institutions  may  reduce  national 
options  and  precedents  may  be  set  by  exigencies,  rather  than  forethought. 

Conclusion:  A  Caveat 

Despite  the  apparent  attractiveness  of  addressing  the  potential  international  legal  issues 
arising  from  the  development  of  information  warfare  technologies  and  techniques  before 
the  issues  actually  arise,  it  is  important  to  remember  (and  easy  for  lawyers  to  forget)  that 
law  is  no  panacea.  Even  the  wisest  agreements  and  soundest  legal  analysis  will  not 
guarantee  the  safety  of  U.S.  systems  or  the  potency  of  U.S.  offensive  measures.  Law  can 
go  a  long  way  toward  regulating  nations'  and  individuals'  behavior,  and  it  can  be  an 
important  part  of  diplomatic  efforts  both  to  alleviate  conflict  and  to  address  its  effects.  At 
the  same  time,  though,  the  development  of  advanced  information  warfare  technologies 
and  techniques  and  the  continuing  global  diffusion  of  information  technology  illustrate 
the  fluidity  of  the  world  that  law  attempts  to  govern.  No  law  can  change  as  swiftly  as  can 
technology;  unless  law  is  to  somehow  stop  technology's  seemingly  inexorable  worldwide 
progress,  it  cannot  fully  control  the  use  of  its  fruits  for  warfare.  Legal  measures  can  thus 
supplement,  but  not  supplant,  vigilance,  preparedness,  and  ingenuity. 
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See  Colleen  Driscoll  Sullivan,  The  Prevention  of  an  Arms  Race  in  Outer  Space:  An 
Emerging  Principle  of  International  Law,  4  Temp.  IntT  &  Comp.  L.J.  211,  230-34 
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Sullivan,  supra  note  54  at  213-14 

See,  infra  Part  111.  C.,  and  Part  111.  E.  2.  a.  (discussions  of  "force"  and  "armed  attack"). 
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See  Reynolds,  supra  note  50,  at  241  (unclear  whether  space-based  lasers  would  count 
as  "weapons  of  mass  destruction").  See  also  John  M.  Orr,  Comment,  The  Treaty  on  Outer 
Space:  An  Evaluation  of  the  Arms  Control  Provisions,  7  Colum.  J.  Transnafl  L.  259 
(1968). 

Aldrich,  supra  note  2,  at  20. 
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Kanuck,  supra  note  15,  at  276;  Abram  N.  Shulsky,  Silent  Warfare;  Understanding  the 
World  of  Intelligenee  103  (2d  ed.  1993) 

Reynolds,  supra  note  50  at  239-41;  Mark  Orlove,  Spaeed  Out:  The  Third  World  Looks 
for  a  Way  in  to  Outer  Spaee,  4  Conn.  J.  Infl  L.  L.  597,  629-32  (1989). 
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to  the  Protection  of  Victims  of  International  Armed  Conflicts  (1977)  (hereinafter 
Additional  Protocol  1).  Although  the  United  States  has  not  ratified  the  Additional 
Protocol,  the  protocol  reflects  much  customary  and  conventional  international  law. 
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Hague  Convention  (V)  Respecting  the  Rights  and  Duties  of  Neutral  Powers  and 
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See  Part  111.  C.,  infra. 
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neutrals  were  obliged  to  prevent  the  entry  of  belligerent  military  aircraft  into  their 
airspace,  compel  their  landing,  and  prevent  their  departure  . 

Hague  V,  Art.  3,  5. 
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391,396(1993). 

Hague  IV,  Art.  25 

80 

Statute  of  the  International  Tribunal  for  the  Proseeution  of  Persons  Responsible  for 
Serious  Violations  of  International  Humanitarian  Law  Committed  in  the  Territory  of  the 
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(1992).  Nevertheless,  the  Nuremberg  tribunal  reaffirmed  that  attaeks  direeted  at  eivilians 
as  eivilians  was  illegal.  George  Bunn,  US  Law  of  Nuelear  Weapons,  32  Naval  War 
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8,  1995,  at  1. 
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Amendments  of  the  Brazilian  Delegation  to  the  Dumbarton  Oaks  Proposals,  Doc.  2, 
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See  discussion  of  "armed  attack,"  Part  III.  E.  2.  a.,  infra. 
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Norman  Menachem  Feder,  Note,  Reading  the  UN  Charter  Connotatively:  Toward  a 
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Peter  G.  Neumann,  Computer  Related  Risks  126-28  (1995).  See  also,  M.E.  Bowman, 
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